HTML entities are decoded in the final page when a performance option is on

## Subject

Route 66 2.4.1 — HTML entities are decoded in the final page when a performance option is on

## What happens

With any of the four performance options of Route 66 enabled, HTML entities disappear from the rendered page. Two things I noticed on Joomla 6.1.3 / PHP 8.3.30 / Route 66 2.4.1:

- a tag titled `audit & diagnostic` reaches the browser as `audit & diagnostic` — a bare ampersand in the markup, where Joomla had output `audit & diagnostic`
- a code sample published in an article, written as `<b>bold</b>` so that readers see the tag, is rendered as actual bold text instead

The second one is what put me on the trail: I write documentation articles that show HTML, and none of them display correctly.

## Steps to reproduce

1. Joomla 6.1.3, Route 66 2.4.1, any template.
2. In Route 66 options, set **lazy load images** to yes, leave the other three off.
3. Create a tag named `A & B`, assign it to an article, display tags on the article.
4. Put the literal text `<b>bold</b>` in the article body.
5. Look at the response source on the front end: the tag shows a bare `&`, and the escaped tag has become bold text.
6. Set the four performance options to no: correct output returns.

## Where it comes from

`administrator/components/com_route66/src/Helper/PerformanceHelper.php`, in `optimize()`:

```php
$buffer = $dom->saveHTML();
$buffer = str_replace('', '', $buffer);
$buffer = html_entity_decode($buffer, ENT_HTML5, 'UTF-8');   // <- here

$application->setBody($buffer);
```

Called from `plugins/system/route66/src/Extension/Route66.php` in `onAfterRender()`.

The decode looks intended to undo the numeric entities `DOMDocument::saveHTML()` produces for non-ASCII characters. Applied to the whole buffer, it also removes the entities that belonged to the content.

Worth noting: `prepareProtectedBlocks()` already shields `

`, `` and `` from the DOM round-trip — but the decode runs after those blocks are restored, so a code sample inside `<code>` loses its entities anyway. The protection is there, the final decode undoes it.<br>
<br>
## Trigger<br>
<br>
`optimize()` returns early only when all four options are off, so enabling a single one is enough for the whole page to be decoded:<br>
<br>
```php<br>
if (!$params->get('iframe_facades') && !$params->get('iframes_lazy_load')<br>
    && !$params->get('images_lazy_load') && !$params->get('optimize_css')) {<br>
    return;<br>
}<br>
```<br>
<br>
## A possible fix<br>
<br>
Decode only what `saveHTML()` introduced — numeric entities above codepoint 127 — and leave named entities from the content alone:<br>
<br>
```php<br>
$buffer = preg_replace_callback(<br>
    '/&#(?:(\d+)|[xX]([0-9a-fA-F]+));/',<br>
    static function (array $m): string {<br>
        $cp = $m[1] !== '' ? (int) $m[1] : (int) hexdec($m[2]);<br>
        return $cp > 127 ? mb_chr($cp, 'UTF-8') : $m[0];<br>
    },<br>
    $buffer<br>
);<br>
```<br>
<br>
## Workaround meanwhile<br>
<br>
Setting the four performance options to no is enough — routing and SEF are untouched, only the optimizer stops running.<br>
					</div>

					
									</div>

				<div class="ats-post-footer ats-threaded-item-footer">
					
					
									</div>
			</div>
		</div>
	</div>
</div>					<div class="card mb-3 border-success ats-post ats-threaded-item post-status-published ats-post-group-1 ats-post-group-8" id="p7629">
	<h3 class="card-header h5 text-white bg-success border-success ats-post-header">
		<span title="Web" class="hasTooltip ats-post-origin">
			<span class="fa fa-globe" aria-hidden="true"></span>
		</span>

				<a href="https://www.firecoders.com/help-desk/route-66/1546-html-entities-are-decoded-in-the-final-page-when-a-performance-option-is-on#p7629" class="ms-2 text-white ats-post-date">
		Thursday, 27 August 2026 18:24 EEST		</a>
	</h3>
	<div class="card-body p-0">
		<div class="ats-post-columns-container ats-threaded-item-container row col-12 mx-0 ats-post-columns-container">
			<div class="order-md-1 col-12 col-md-4 col-xl-3 d-flex flex-column justify-content-start p-1 bg-light ats-post-userinfo ats-threaded-item-userinfo">
												<div class="text-center m-1 ats-post-userinfo-avatar ats-threaded-item-userinfo-avatar">
					<img src="https://www.gravatar.com/avatar/92c0e8f143cf7c39b65afc3d5b3688e072401a0d5aaedc63ab9f120e490add13?s=64" alt="" width="64" class="img-fluid rounded rounded-3" loading="lazy">
				</div>
				
				
				<div class="mb-1 d-flex justify-content-center align-items-center ats-post-userinfo-username ats-threaded-item-userinfo-username">
					<div class="font-monospace flex-shrink-1 ats-post-userinfo-username-label ats-threaded-item-username-label">
													Lefteris Kavadas											</div>
									</div>

				
				
				
							</div>
						<div class="order-md-0 col-12 col-md-8 col-xl-9 py-2 d-flex flex-column ats-post-body-container ats-threaded-item-body-container">
				<div class="flex-grow-1 mb-2 ats-post-content">
					<div class="mb-2 ats-post-content-html ats-threaded-item-content-html">
						<p>Hi,</p>
<p>Thank you for the detailed report and excellent analysis. You were correct: the final <code>html_entity_decode()</code> was decoding entities belonging to the page content after the protected blocks had been restored.</p>
<p>We have fixed this for the next Route 66 release. The optimizer no longer decodes the complete HTML response. Instead, <code><style></code> and <code><script></code> contents are protected during the DOM serialization and restored verbatim afterward. This preserves CSS icon glyphs—the reason decoding was originally introduced—without affecting entities such as <code>&</code> and <code><</code> in page content or code samples.</p>
<p>We also corrected the insertion of combined CSS so ampersands and other special characters are preserved correctly.</p>
<p>The fix has been tested on PHP 8.2 through 8.5 with all four performance-option paths, including the reproduction cases from this ticket.</p>
<p>Until the update is available, disabling the four performance options remains a valid workaround. Routing and SEF functionality are unaffected.</p>
<p>Thanks again for providing such a clear reproduction and pointing directly to the problematic code.<br> <br>Best regards,<br>Lefteris</p>					</div>

					
									</div>

				<div class="ats-post-footer ats-threaded-item-footer">
					
					
									</div>
			</div>
		</div>
	</div>
</div>			</section>

	

		
	
		
<div id="mod-custom109" class="mod-custom custom">
    <p class="text-muted"><em>Note: An active subscription is required in order to get support for our paid extensions. For our free extensions, if you don't have an account, <a href="/register">register</a> and then submit your support request.  In case you just want to ask a question, you can also use the <a href="/contact">contact form</a> .</em></p></div>
	<div id="ats-onsubmit-overlay" style="display:none;">
	<div class="ats-onsubmit-container">
		<div class="ats-onsubmit-message" aria-modal="true" role="alertdialog">
			<p class="ats-onsubmit-spinner">
				<span class="fa fa-spinner"></span>
			</p>

			<h3>
				Please wait			</h3>
			<p>
				Your post is being submitted…			</p>
		</div>

	</div>
</div>
</div>
						</div>
						
				</div>
			</div>
		</div>

		
		
		<div id="zone-3">
			<div class="container-fluid">
				<div class="row footer-content">
					<div class="footer-links-area col-xs-12 col-sm-3">
						<h3><strong>Useful</strong> links</h3>
												<div class="footer-links">
							<div class="moduletable ">
        <nav>


<ul class="menu">
<li class="item-123"><a href="/contact"><span>Contact us</span></a></li><li class="item-118"><a href="/about-us"><span>About Us</span></a></li><li class="item-119"><a href="/license-terms-of-service"><span>License & Terms of Service</span></a></li><li class="item-1143"><a href="/privacy-policy"><span>Privacy Policy</span></a></li><li class="item-916"><a class="privacy-settings" href="#"><span>Cookies</span></a></li></ul>
</nav>
</div>

						</div>
											</div>
					<div class="social-area col-xs-12 col-sm-6">
						<h3><strong>Keep</strong> in touch with us</h3>
						<a title="Firecoders on Facebook" href="https://www.facebook.com/firecoders.joomla/" rel="noopener" target="_blank"><span><svg><use xlink:href="#icon-facebook"></use></svg></span></a>
						<a title="Firecoders on Twitter" href="https://www.twitter.com/firecoders" rel="noopener" target="_blank"><span><svg><use xlink:href="#icon-twitter"></use></svg></span></a>
						<a title="Firecoders on YouTube" href="https://www.youtube.com/channel/UC0p8qEz7Q96PpY-bTiZXIrg" rel="noopener" target="_blank"><span><svg><use xlink:href="#icon-youtube"></use></svg></span></a>
						<a title="Firecoders on GitHub" href="https://github.com/kavadas" rel="noopener" target="_blank"><span><svg><use xlink:href="#icon-github"></use></svg></span></a>
						<a title="Firecoders on LinkedIn" href="https://www.linkedin.com/in/lefteris-kavadas" rel="noopener" target="_blank"><span><svg><use xlink:href="#icon-linkedin"></use></svg></span></a>
					</div>
					<div class="footer-links col-xs-12 col-sm-3">
						<h3><strong>Joomla</strong> extensions</h3>
						<ul>
							<li><a title="CommentBox for Joomla" href="https://www.firecoders.com/joomla-extensions/commentbox">CommentBox</a></li>
							<li><a title="Econa for Joomla" href="https://www.firecoders.com/joomla-extensions/econa">Econa</a></li>
							<li><a title="Route 66 for Joomla" href="https://www.firecoders.com/joomla-extensions/route-66">Route 66</a></li>
							<li><a title="Showtime Image Gallery for Joomla" href="https://www.firecoders.com/joomla-extensions/showtime-image-gallery">Showtime Image Gallery</a></li>
						</ul>
					</div>
				</div>
				<div class="footer-copyrights">
					<div>Copyright © 2016 - 2026 Firecoders - All Rights Reserved.</div>
					<div>Firecoders is not affiliated with or endorsed by the Joomla! Project or Open Source Matters. The Joomla! name and logo is used under a limited license granted by Open Source Matters, the trademark holder in the United States and other countries.</div>
				</div>
			</div>
		</div>

	</div>
			<div id="exit-modal">
			<div>
				<div id="exit-modal-contents">
					<img src="/templates/firecoders/images/firecoders-logo.svg" alt="Firecoders" loading="lazy">
					<div class="exit-modal-variation">
						<div class="exit-modal-text">Are you using our extensions? Please post a review at the Joomla extensions directory!</div>
						<div>
							<a class="btn btn-primary btn-lg" href="https://extensions.joomla.org/instant-search/?jed_live%5Bquery%5D=firecoders" target="_blank" rel="noopener">Post a review</a>
						</div>
					</div>
										<a class="exit-modal-close-button" onclick="jQuery('body').removeClass('has-modal');jQuery('#exit-modal').remove(); return false;" title="Close"><svg class="icon icon-cross"><use xlink:href="#icon-cross"></use></svg></a>
				</div>
			</div>
		</div>
		<script>
		var body = jQuery('body');
		var now = Date.now();
		var lastModal = localStorage.getItem('exit-modal-last-shown') || 0;
		var canShow = (now-parseInt(lastModal) > 2592000000); //One month
		if(window.innerWidth >= 768) {
			body.one('mousemove', function() {
				jQuery(document).trigger('mouseenter');
					jQuery(document).mouseleave(function(event) {
						if(canShow && event.clientY < 10 && !body.hasClass('has-modal')) {
								localStorage.setItem('exit-modal-last-shown', now);
								var random = Math.floor(Math.random() * 3);
																jQuery('.exit-modal-variation:eq(0)').css('display', 'block');
								body.addClass('has-modal');
								canShow = false;
						}
					});
			});
		}
	</script>

  <script>
    var privacySettingsButton = document.querySelector('.privacy-settings');
    if(privacySettingsButton) {
      privacySettingsButton.addEventListener('click', function(event) {
        event.preventDefault();
		//if(window.googlefc) {
		//	googlefc.showRevocationMessage();
		//}
		window.__tcfapi('displayConsentUi', 2, function() {} );
      });
    }
 </script>
</body>
</html>