hhuijser/liferay-plugins — pull request #178 by daledotshan (2014-03-28 06:49:41+00:00)
Title: Lps 45361

It is safe to remove the escape, because when we add or update a CalendarBooking, we already sanitized description of CalendarBooking.
See following code snippet of addCalendarBooking of CalendarBookingLocalServiceImpl
for (Locale locale : descriptionMap.keySet()) {
String sanitizedDescription = SanitizerUtil.sanitize(
calendar.getCompanyId(), calendar.getGroupId(), userId,
CalendarBooking.class.getName(), calendarBookingId,
ContentTypes.TEXT_HTML, Sanitizer.MODE_ALL,
descriptionMap.get(locale), null);

descriptionMap.put(locale, sanitizedDescription);
}

Here is sample data of CalendarBooking (You can see we already escape some special character)

&nbsp;</p>

<p>&lt;script&gt;alert("haha")&lt;/script&gt;</p>language-id="en_US"><p><strong>sdfsdfsdfsfs</strong></p>

<p>&lt;this is&nbsp; a test&gt;</p>