API result values should be literal strings rather than HTML entities (Maybe a bug?)

[Sxderp]

Server (please complete the following information):

• Snipe Version: 4.7.7
• OS: RHEL 7
• Web Server: Apache
• PHP Version: 7.1

Is your feature request related to a problem? Please describe.
When fetching assets that have certain characters in field values or model name those characters are turned into HTML entities. The HTML entities are returned in the API output. The escaping seems to happen in the "Transformer" classes.

Reproduce:

1. Create a Model with a " in the name.
2. Create an asset with that model.
3. Query that asset using the API.
4. Examine API output. The model name will contain the HTML entity ".

Describe the solution you'd like
The API should return literal strings.

Describe alternatives you've considered
Manually un-escaping the HTML entities in my scripts.

[stale]

Is this still relevant? We haven't heard from anyone in a bit. If so, please comment with any updates or additional detail.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Don't take it personally, we just need to keep a handle on things. Thank you for your contributions!

[Sxderp]

yes

[stale]

Okay, it looks like this issue or feature request might still be important. We'll re-open it for now. Thank you for letting us know!

[stale]

Is this still relevant? We haven't heard from anyone in a bit. If so, please comment with any updates or additional detail.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Don't take it personally, we just need to keep a handle on things. Thank you for your contributions!

[Sxderp]

yes

[stale]

Okay, it looks like this issue or feature request might still be important. We'll re-open it for now. Thank you for letting us know!

[travismiller]

This is unexpected behavior. I would expect the API to output data exactly as input.

Unfortunately, changing this would be a breaking change as existing code is likely expecting current behavior.

It would be good to get this included in v5 with maybe an optional configuration and/or parameter for handling this as desired in v4.

This is something I may be able to help with.

[stale]

Is this still relevant? We haven't heard from anyone in a bit. If so, please comment with any updates or additional detail.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Don't take it personally, we just need to keep a handle on things. Thank you for your contributions!

[travismiller]

This is still relevant

…

On Aug 8, 2020, at 02:24, stale[bot] ***@***.***> wrote: still relevant

[stale]

Okay, it looks like this issue or feature request might still be important. We'll re-open it for now. Thank you for letting us know!

[stale]

Is this still relevant? We haven't heard from anyone in a bit. If so, please comment with any updates or additional detail.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Don't take it personally, we just need to keep a handle on things. Thank you for your contributions!

[Sxderp]

Yes

[stale]

Okay, it looks like this issue or feature request might still be important. We'll re-open it for now. Thank you for letting us know!

[stale]

Is this still relevant? We haven't heard from anyone in a bit. If so, please comment with any updates or additional detail.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Don't take it personally, we just need to keep a handle on things. Thank you for your contributions!

[travismiller]

Yes

[stale]

Okay, it looks like this issue or feature request might still be important. We'll re-open it for now. Thank you for letting us know!

[mattcarras]

+1

My scripts unescape all returned strings as I'm not exactly sure which strings may have HTML entities in them.

[snipe]

This would leave us open to XSS attacks everywhere that we consume the API.

[bby-bishopclark]

is 9cf5f30 a response to this, or unrelated?