That's because it's an HTML entity and not an encoded URI. You could use [`ZU.unescapeHTML`](https://github.com/zotero/zotero/blob/master/chrome/content/zotero/xpcom/utilities.js#L401), but it probably makes more sense to simply use a [DOMParser](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) to parse the response.