Duplicate Style Properties are not escaped when XML files are produced

[Xon]

Affected version

2.0.1

The php cmd.php xf-addon:build-release command does not produced properly formed XML style properties.

consider the style property with the following free-form LESS/CSS;

margin-top: 4px;
margin-right: 4px;

&:last-child
{
	margin-right: 0;
}

This is outputted in style_properties.xml as:

    <value>{
    "extra": "margin-top: 4px;\nmargin-right: 4px;\n\n&:last-child\n{\n\tmargin-right: 0;\n}"
}</value>

This looks to be json dumped into XML, as there are unescaped & entities.

 

[Xon]

jsonEncodePretty is also used in XF\Service\Style\Export which doesn't look safe

 

[Mike]

I'm pretty sure this is actually the same as: https://xenforo.com/community/threads/exporting-style-errorexception.140023/ (I fixed all of the references with that.)