Unable to enter `+` character in widget content

[molovo]

Preconditions

1. Magento version: 2.2.3 (I haven't yet tested other versions)

Steps to reproduce

1. Create a widget with a parameter of xsi:type="text" or xsi:type="block" with a textarea block
2. Add the widget to the content of a CMS page
3. Enter a string containing a + character into the text field of the widget

Expected result

1. The + character appears on the rendered page

Actual result

1. The + character is missing from the rendered page. It is still present in the page content stored in the database, and appears when editing the widget.

Example widget parameter declaration

<parameter name="title" xsi:type="text" visible="true">
  <label translate="true">Title</label>
</parameter>

<parameter name="content" xsi:type="block" required="true" visible="true">
  <label translate="true">Content</label>

  <block class="<vendor>\<module>\Block\Adminhtml\Widget\TextArea"/>
</parameter>

Example TextArea block

<?php

namespace <vendor>\<module>\Block\Adminhtml\Widget;

use Magento\Backend\Block\Template\Context;
use Magento\Backend\Block\Widget\Form\Element;
use Magento\Cms\Model\Wysiwyg\Config;
use Magento\Framework\Data\Form\Element\AbstractElement;
use Magento\Framework\Data\Form\Element\Factory;

class TextArea extends Element
{
    protected $_elementFactory;

    /**
     * @param Context $context
     * @param Factory $elementFactory
     * @param array   $data
     * @param Config  $config
     */
    public function __construct(Context $context, Factory $elementFactory, Config $config, array $data = [])
    {
        $this->_elementFactory = $elementFactory;
        $this->_wysiwygConfig  = $config;
        parent::__construct($context, $data);
    }

    /**
     * Prepare chooser element HTML.
     *
     * @param AbstractElement $element Form Element
     *
     * @return AbstractElement
     */
    public function prepareElementHtml(AbstractElement $element)
    {
        $input = $this->_elementFactory->create('textarea', ['data' => $element->getData()])
            ->setId($element->getId())
            ->setClass('widget-option input-textarea admin__control-text')
            ->setForm($element->getForm());

        if ($element->getRequired()) {
            $input->addClass('required-entry');
        }

        $element->setData('after_element_html', $input->getElementHtml());

        return $element;
    }
}

Hello @molovo , thank you for your report.
We've acknowledged the issue and added to our backlog.

[molovo]

Just wanted to add, I've recently updated to 2.2.5, and the issue still persists.

[molovo]

I've done some more research into this as I needed to launch the site on which I discovered the error, and uncovered the following:

• Typing the + character into the field in the widget form results in + being inserted into the WYSIWYG, and saved directly to the database, and nothing is rendered on the front end.
• When you type + into the widget field, the text + is being inserted into the WYSIWYG, which results in + being printed on the front end due to the ampersand being escaped.
• If you hide the WYSIWYG, and replace any + characters with + directly, the + character then appears on the front end.

It seems as though there are two incorrect things happening here:

• The + character is being excluded from the HTML entity encoding when the widget is inserted into the WYSIWYG
• When the + character makes it through to the database unescaped, it is being stripped from the content when it is rendered - the escaped version is still rendered as expected

Hopefully this will help point you in the right direction for fixing the issue