From a1e674940b6620de6541180302622e3a3bc67885 Mon Sep 17 00:00:00 2001
From: Vincent Gao <vincent.gao@dpc.vic.gov.au>
Date: Tue, 18 Jun 2024 09:40:13 +1000
Subject: [PATCH] HTML `&nbsp;` not being correctly filtered out

---
 core/lib/Drupal/Component/Utility/Html.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/lib/Drupal/Component/Utility/Html.php b/core/lib/Drupal/Component/Utility/Html.php
index 1706b0cde6..28173c08ee 100644
--- a/core/lib/Drupal/Component/Utility/Html.php
+++ b/core/lib/Drupal/Component/Utility/Html.php
@@ -329,6 +329,11 @@ public static function serialize(\DOMDocument $document) {
     // Normalize all newlines.
     $html = str_replace(["\r\n", "\r"], "\n", $html);
 
+    // Process unconverted &nbsp; entities, excluding content within <code> tags.
+    $html = preg_replace_callback('/<(code|a)[^>]*>.*?<\/\1>(*SKIP)(*FAIL)|&nbsp;/s', function ($matches) {
+      return ' ';
+    }, $html);
+
     return $html;
   }
 
-- 
2.39.3 (Apple Git-146)