Deprecated the $preserveEntites argument of Xml::escape() for rem…

…oval in the next release (#353)

CHANGELOG.md

@@ -12,6 +12,10 @@ Updates should follow the [Keep a CHANGELOG](http://keepachangelog.com/) princip
 
  - Fix XSS vulnerability caused by improper preservation of entities when rendering (#353)
 
+### Deprecated
+
+ - Deprecated the `$preserveEntites` argument of `Xml::escape()` for removal in the next release (#353)
+
 ## [0.18.2] - 2019-03-16
 
 ### Fixed

src/Util/Xml.php

@@ -25,10 +25,14 @@ final class Xml
      *
      * @return string
      */
-    public static function escape($string, $preserveEntities = false)
+    public static function escape($string, $preserveEntities = null)
     {
-        if ($preserveEntities) {
+        if ($preserveEntities === true) {
+            @trigger_error('Preserving entities in Xml::escape() has been deprecated and will be removed in the next release', E_USER_DEPRECATED);
             $string = preg_replace('/[&](?![#](x[a-f0-9]{1,8}|[0-9]{1,8});|[a-z][a-z0-9]{1,31};)/i', '&', $string);
+        } elseif ($preserveEntities === false) {
+            @trigger_error('The $preserveEntities argument of Xml::escape() has been deprecated and will be removed in the next release', E_USER_DEPRECATED);
+            $string = str_replace('&', '&', $string);
         } else {
             $string = str_replace('&', '&', $string);
         }