Merge #16826: Do additional character escaping for wallet names and address labels

ad52f054f67374dc46e0096d1e2f593d6372a2df Escape ampersands (&) in wallet names in Open Wallet menu (Andrew Chow)
2c530ea2ada71ca23fa17bab5023b855515463ef HTML escape address labels in more dialogs and notifications (Andrew Chow)
1770a972d471d2bdb36195ec370b6fc238649f4d HTML escape the wallet name in more dialogs and notifications (Andrew Chow)

Pull request description:

  Fixes some places where wallet names and address labels which contain valid html or other interpreted characters are displayed incorrectly.

  In the send coins dialog, if the wallet name or the address label contains valid html, then the html would be shown rather than the literal string for the wallet name or label. This PR fixes that so the true name or label is shown.

  The Open Wallet menu would incorrectly show wallet names with ampersands (`&`). For some reason, Qt removes the first ampersand in a string. So by replacing the first ampersand with 2 ampersands, the correct number of ampersands will be shown.

  Fixes the HTML escaping issues in #16820

ACKs for top commit:
  laanwj:
    Untested ACK, thanks for adding proper escaping, ad52f054f67374dc46e0096d1e2f593d6372a2df
  fanquake:
    ACK ad52f054f67374dc46e0096d1e2f593d6372a2df

Tree-SHA512: 264bef28a8061c7f43cc30c3e04b361c614ea78b9915e8763c44553c8967131b066db500977fa6130de1f8874b9bba59e630486c58e1e3c5c165555105a6c254

4 files changed, 7 insertions, 5 deletions

diff --git a/src/qt/bitcoingui.cpp b/src/qt/bitcoingui.cpp
index de6e1ca00e..c672171cfb 100644
--- a/src/qt/bitcoingui.cpp
+++ b/src/qt/bitcoingui.cpp
@@ -375,6 +375,8 @@ void BitcoinGUI::createActions()
             for (const std::pair<const std::string, bool>& i : m_wallet_controller->listWalletDir()) {
                 const std::string& path = i.first;
                 QString name = path.empty() ? QString("["+tr("default wallet")+"]") : QString::fromStdString(path);
+                // Menu items remove single &. Single & are shown when && is in the string, but only the first occurrence. So replace only the first & with &&
+                name.replace(name.indexOf(QChar('&')), 1, QString("&&"));
                 QAction* action = m_open_wallet_menu->addAction(name);
 
                 if (i.second) {
diff --git a/src/qt/sendcoinsdialog.cpp b/src/qt/sendcoinsdialog.cpp
index f23c47736f..a88119d8c5 100644
--- a/src/qt/sendcoinsdialog.cpp
+++ b/src/qt/sendcoinsdialog.cpp
@@ -283,7 +283,7 @@ void SendCoinsDialog::on_sendButton_clicked()
         // generate amount string with wallet name in case of multiwallet
         QString amount = BitcoinUnits::formatWithUnit(model->getOptionsModel()->getDisplayUnit(), rcp.amount);
         if (model->isMultiwallet()) {
-            amount.append(tr(" from wallet '%1'").arg(model->getWalletName()));
+            amount.append(tr(" from wallet '%1'").arg(GUIUtil::HtmlEscape(model->getWalletName())));
         }
 
         // generate address string
@@ -297,7 +297,7 @@ void SendCoinsDialog::on_sendButton_clicked()
         {
             if(rcp.label.length() > 0) // label with address
             {
-                recipientElement.append(tr("%1 to '%2'").arg(amount, rcp.label));
+                recipientElement.append(tr("%1 to '%2'").arg(amount, GUIUtil::HtmlEscape(rcp.label)));
                 recipientElement.append(QString(" (%1)").arg(address));
             }
             else // just address
diff --git a/src/qt/walletcontroller.cpp b/src/qt/walletcontroller.cpp
index 1a4f51c066..8b8283d3d8 100644
--- a/src/qt/walletcontroller.cpp
+++ b/src/qt/walletcontroller.cpp
@@ -75,7 +75,7 @@ void WalletController::closeWallet(WalletModel* wallet_model, QWidget* parent)
 {
     QMessageBox box(parent);
     box.setWindowTitle(tr("Close wallet"));
-    box.setText(tr("Are you sure you wish to close wallet <i>%1</i>?").arg(wallet_model->getDisplayName()));
+    box.setText(tr("Are you sure you wish to close wallet <i>%1</i>?").arg(GUIUtil::HtmlEscape(wallet_model->getDisplayName())));
     box.setInformativeText(tr("Closing the wallet for too long can result in having to resync the entire chain if pruning is enabled."));
     box.setStandardButtons(QMessageBox::Yes|QMessageBox::Cancel);
     box.setDefaultButton(QMessageBox::Yes);
diff --git a/src/qt/walletview.cpp b/src/qt/walletview.cpp
index be47f67f95..8652827b59 100644
--- a/src/qt/walletview.cpp
+++ b/src/qt/walletview.cpp
@@ -170,9 +170,9 @@ void WalletView::processNewTransaction(const QModelIndex& parent, int start, int
     QString type = ttm->index(start, TransactionTableModel::Type, parent).data().toString();
     QModelIndex index = ttm->index(start, 0, parent);
     QString address = ttm->data(index, TransactionTableModel::AddressRole).toString();
-    QString label = ttm->data(index, TransactionTableModel::LabelRole).toString();
+    QString label = GUIUtil::HtmlEscape(ttm->data(index, TransactionTableModel::LabelRole).toString());
 
-    Q_EMIT incomingTransaction(date, walletModel->getOptionsModel()->getDisplayUnit(), amount, type, address, label, walletModel->getWalletName());
+    Q_EMIT incomingTransaction(date, walletModel->getOptionsModel()->getDisplayUnit(), amount, type, address, label, GUIUtil::HtmlEscape(walletModel->getWalletName()));
 }
 
 void WalletView::gotoOverviewPage()