When submitting HTML that contains entities to the OWASP HTMLSanitzer, entities are converted.
BEFORE: <p>blah blah blah ♦</p>
The resulting HTML ends up looking like this:
AFTER: <p>blah blah blah ?</p>
The entity is converted back to it's original unicode character.
Why does OWASP do that? Are entities unsafe? For me, having the entities solves any issues down the road with unicode text.
Additionally, is there a way to allow the entities to remain untouched in HTMLSanitzer?