\Drupal\sharethis\SharethisManager::renderSpans deals with escaping in an inconsistent way

Problem/Motivation

There are several potential problems when variables are put onto the screen:

• You miss to escape it in the first place
• You escape it twice

The code

      // Switch the title on a per-service basis if required.
      // $mtitle = $mtitle;.
      switch ($service_code_name) {
        case 'twitter':
          $mtitle = empty($data_options['twitter_suffix']) ? $mtitle : Html::escape($mtitle) . ' ' . Html::escape($data_options['twitter_suffix']);
          break;
      }

seems to escape in one case, but not in the other.

In other words, we maybe have no escaping (a potential security problem) or double escaping, which deals to annoying " quotes.

Proposed resolution

• Validate by putting some simple JS into these title, whether the Drupal Attribute functionality escapes automatically
• In case it doesn't, the first condition in the code above needs to be escaped
• Otherwise the other escapes might be redundant

Remaining tasks

User interface changes

API changes

Data model changes