HTML-escaped characters in strings are unescaped when converting to XML elements

[bcpmihail]

Description

We have a JS vro project, containing the following action:

(function () {
    var Strings = function () {
        throw new Error("private constructor");
    };
    Strings.escapeHtml = function (str) {
        return str
            .replace(/&/g, "&")
            .replace(/\</g, "&lt;")
            .replace(/\>/g, "&gt;")
            .replace(/'/g, "&#39;")
            .replace(/"/g, "&quot;");
    };
    return Strings;
})

When used as a dependency in another JS vro project, in the copied Strings.js file in the target dependencies folder, the escapeHtml method is changed to:

Strings.escapeHtml = function (str) {
    return str
        .replace(/&/g, "&")
        .replace(/\</g, "<")
        .replace(/\>/g, ">")
        .replace(/'/g, "'")
        .replace(/"/g, """);
};

Causing the following error (shortened):

Error in beforeEach: C:\DEV\Github\pscoe.reusable-components.wl.nsx\target\vro-tests\dependencies\...\elements\...\Strings.js:226
[ERROR]         .replace(/"/g, """);
[ERROR]                        ^^

It seems that strings containing HTML-escaped characters are being "unescaped".

Steps to Reproduce

1. In a JS project, add the Strings JS action above and build
2. In another test JS project, use Strings in a JS action:

var Strings = System.getModule("first.test.project").Strings();
...
var escapedString= Strings.escapeHtml("sometString");

3. Create a unit test for the action, placing the setup (fetching the action) in a try/catch block, outputting the stack of the error to the console.
4. Build and run (mvn clean install) the (second) test project

Expected behavior: The (second) test project builds and tests pass successfully.

Actual behavior: There is an error for Strings.js

Reproduces how often: Always

Component/s: typescript/vropkg

Affects Build/s: [Which are the Build Tools for VMware Aria releases / builds affected by the issue]

Environment

Client

• Build Tools for VMware Aria Version: 2.43.0
• Visual Studio Code Version: 1.98.2
• OS Version: Windows 11

Dependencies

Run: curl -o- https://raw.githubusercontent.com/vmware/build-tools-for-vmware-aria/main/health.sh | bash and paste the output here:
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2877 100 2877 0 0 7173 0 --:--:-- --:--:-- --:--:-- 7192
Starting VMware Aria Build Tools Checks...
Starting VMware Aria Build Tools Checks...
✔ Node.js version 22.14.0 is within the required range (22 - 22).
✔ Maven version 3.9.9 meets the minimum requirement (>= 3.9).
✔ Java version 17.0.11 is within the required range (17 - 21).
All checks passed successfully.

Server

• vRealize Automation Version:
• vRealize Orchestrator Version:
• vRealize Operations Version:
• vRealize Log Insight Version:

Failure Logs

Related issues and PRs

Additional Context

[bcpmihail]

Note:
When the first project is built, the method is ok in the "data" file in the element generated for Strings;
The "data" file is still ok when imported as dependency in the second project (dependency/vro, vrotest/dependencies/first.test.project-version/elements/someelementhash/data)
The issue is with the extracted Strings.js file (in dependency/vro, vrotest/dependencies/first.test.project-version/elements/someelementhash)

[bcpmihail]

More notes:
Search btva code for regex "iconv-lite"|"charset-detector"; there only seems to be decoding and no encoding when dealing with script element contents;
For use of xml, track through vropkg:
parseFlatElement(parse/flat.ts) - xml (stands for new xmldoc.XmlDocument(data)) - test if characters are unescaped here
VroJsProjRealizer.writeJsFile(serialize/js.ts)

[bcpmihail]

The decoding method in vrotsc/util:

export function decodeBuffer(buf: Buffer): string {
	const encodings = charsetDetector(buf);
	if (encodings.length) {
		const encoding = encodings[0].charsetName;
		return iconv.decode(buf, encoding);
	}
	else {
		return buf.toString("utf8");
	}
}

differs from the one in vropkg/encoding:

export const decode = (buf: Buffer): string => {
	const charEncondings = characterEncoding(buf);
	if (charEncondings.length == 0) {
		winston.loggers.get(WINSTON_CONFIGURATION.logPrefix).info("Encoding not found. Using UTF-16");
		let str = "";
		for (let i = 0; i < buf.length; i++) {
			str += String.fromCharCode(buf[i]);
		}
		
		return str;
	}
	let encoding = charEncondings[0].charsetName;

	return iconvlite.decode(buf, encoding);
}

And also uses "fast-xml-parser" while in vropkg/parse/util new xmldoc.XmlDocument(xmlContent); is used

Note that the default encoding in vropkg/constants is:

export const DEFAULT_ENCODING = { encoding: "utf16le" };

[bcpmihail]

The issue cannot be reproduced when building with BTVA/parent version 4.3.0
Suggested workaround: update parent version in pom file, use BTVA 4.3.0 and above to build locally