+info https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules_Summary

Hi Peter, this doesn't look like it is a bug. If you find that it's an issue outside of what Samuel has described please open another ticket directly addressing that issue. Thank you.

• There's no issue here.

• HtmlUtil.escapeAttribute is the correct method as recommended by OWASP

• We're just encoding certain characters. This is perfectly acceptable in HTML http://en.wikipedia.org/wiki/Character_encodings_in_HTML#HTML_character_references and search engines should have no problem reading it.

Hi Peter,
We'll wait for you to post your results on here and proceed afterwards. Thank you for taking the time to respond and look into this issue.

Sorry... just because I haven't manage to respond in the timeframe that you specified, I really can't understand why this issue can be closed. On the contrary, I am surprised that this bug isn't flagged up more. It has been noticed that even the liferay.com site has this very issue. There is some very recent discussion in the thread that I had quoted in the description of this LPS and someone has suggested where the bug is.

To answer your question, I still haven't been able to install m4 yet, but when I do I will post back here. Thank you.