Toolbar: normalize admin bar title entities

[dhrupo]

Summary

Normalize HTML entities when rendering admin bar node titles without escaping valid markup used by core and plugins.

Problem

WP_Admin_Bar::_render_item() outputs $node->title directly. This means text like This & that is rendered with a literal & instead of a normalized &, while broad escaping approaches would break existing admin bar titles that intentionally include HTML.

Trac ticket: https://core.trac.wordpress.org/ticket/62545

Solution

Use wp_kses_normalize_entities() when rendering the admin bar title. This normalizes entities in text content while preserving valid embedded markup.

Testing

Added a PHPUnit regression test covering an admin bar title that includes both HTML markup and an ampersand.

Verified in the configured local wordpress-develop environment with:

• node ./tools/local-env/scripts/docker.js exec --user wp_php php ./vendor/bin/phpunit --filter test_admin_bar_normalizes_title_entities_without_escaping_html tests/phpunit/tests/adminbar.php
• node ./tools/local-env/scripts/docker.js exec --user wp_php php ./vendor/bin/phpunit tests/phpunit/tests/adminbar.php

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props dhrupo.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.