Fix double escaping in delegate component

src/Compiler/Compiler.php

@@ -162,11 +162,12 @@ protected function compileDelegateComponentTag(ComponentNode $node): string
         $functionName = '(\'' . ($this->manager->isFolding() ? '__' : '_') . '\' . $__resolved)';
 
         $output = '<' . '?php $__resolved = $__blaze->resolve(' . $componentName . '); ?>' . "\n";
-        $output .= '<' . '?php $__blaze->pushData($attributes->all()); ?>' . "\n";
+        $output .= '<' . '?php $__delegatedData = $__blaze->unescapeAttributes($attributes->getAttributes()); ?>' . "\n";
+        $output .= '<' . '?php $__blaze->pushData($__delegatedData); ?>' . "\n";
         $output .= '<' . '?php if ($__resolved !== false): ?>' . "\n";
 
         if ($node->selfClosing) {
-            $output .= '<' . '?php ' . $functionName . '($__blaze, $attributes->all(), $__blaze->mergedComponentSlots(), [], [], $__this ?? (isset($this) ? $this : null)); ?>' . "\n";
+            $output .= '<' . '?php ' . $functionName . '($__blaze, $__delegatedData, $__blaze->mergedComponentSlots(), [], [], $__this ?? (isset($this) ? $this : null)); ?>' . "\n";
         } else {
             $hash = Utils::hash($componentName);
             $slotsVariableName = '$__slots' . $hash;
@@ -175,7 +176,7 @@ protected function compileDelegateComponentTag(ComponentNode $node): string
             $output .= '<' . '?php ' . $slotsVariableName . ' = []; ?>' . "\n";
             $output .= $this->slotCompiler->compile($slotsVariableName, $node->children);
             $output .= '<' . '?php ' . $slotsVariableName . ' = array_merge($__blaze->mergedComponentSlots(), ' . $slotsVariableName . '); ?>' . "\n";
-            $output .= '<' . '?php ' . $functionName . '($__blaze, $attributes->all(), ' . $slotsVariableName . ', [], [], $__this ?? (isset($this) ? $this : null)); ?>' . "\n";
+            $output .= '<' . '?php ' . $functionName . '($__blaze, $__delegatedData, ' . $slotsVariableName . ', [], [], $__this ?? (isset($this) ? $this : null)); ?>' . "\n";
             $output .= '<' . '?php if (! empty(' . $slotsStackName . ')) { ' . $slotsVariableName . ' = array_pop(' . $slotsStackName . '); } ?>' . "\n";
         }
 
@@ -184,7 +185,7 @@ protected function compileDelegateComponentTag(ComponentNode $node): string
         $output .= '<' . '?php endif; ?>' . "\n";
 
         $output .= '<' . '?php $__blaze->popData(); ?>' . "\n";
-        $output .= '<' . '?php unset($__resolved) ?>';
+        $output .= '<' . '?php unset($__resolved, $__delegatedData) ?>';
 
         return $output;
     }

src/Runtime/BlazeRuntime.php

@@ -133,6 +133,20 @@ public function mergedComponentSlots(): array
         return $result;
     }
 
+    /**
+    * Revert escaping of data passed through attributes.
+    */
+    public function unescapeAttributes($data): array
+    {
+        $result = [];
+
+        foreach ($data as $key => $value) {
+            $result[$key] = is_string($value) ? htmlspecialchars_decode($value, ENT_QUOTES) : $value;
+        }
+
+        return $result;
+    }
+
     /**
      * Push component data onto the stack for @aware lookups.
      */

tests/Compiler/CompilerTest.php

@@ -69,14 +69,15 @@
 
     expect($compiled->render())->toEqualCollapsingWhitespace(join('', [
         '<?php $__resolved = $__blaze->resolve(\'flux::\' . card); ?> ',
-        '<?php $__blaze->pushData($attributes->all()); ?> ',
+        '<?php $__delegatedData = $__blaze->unescapeAttributes($attributes->getAttributes()); ?> ',
+        '<?php $__blaze->pushData($__delegatedData); ?> ',
         '<?php if ($__resolved !== false): ?> ',
-        '<?php (\'_\' . $__resolved)($__blaze, $attributes->all(), $__blaze->mergedComponentSlots(), [], [], $__this ?? (isset($this) ? $this : null)); ?> ',
+        '<?php (\'_\' . $__resolved)($__blaze, $__delegatedData, $__blaze->mergedComponentSlots(), [], [], $__this ?? (isset($this) ? $this : null)); ?> ',
         '<?php else: ?> ',
         '<flux:delegate-component component="card" /> ',
         '<?php endif; ?> ',
         '<?php $__blaze->popData(); ?> ',
-        '<?php unset($__resolved) ?>',
+        '<?php unset($__resolved, $__delegatedData) ?>',
     ]));
 });
 

tests/FluxTest.php

@@ -67,4 +67,12 @@
         <flux:select.option>Other</flux:select.option>
     </flux:select>
     BLADE
+));
+
+/**
+ * Checks that bound attributes passed through delegate component aren't double escaped
+ */
+test('select with bound attribute with ampersand', fn () => compare(<<<'BLADE'
+    <flux:select :placeholder="'Country & Region'" />
+    BLADE
 ));