Script src URL Query Params are being Escaped on output

[prkirby]

What did you expect to happen?

When adding a tag to the 'instant_articles_social_embed_youtube' filter, the script src would output as provided

What happened instead?

The script tags src url's query params are being escaped, IE the & is converted to &

How can we reproduce this behavior?

using the code:

function edit_youtube_embed($html) {
    //set up script without escaping query args
    $scriptSrc = esc_url(
      add_query_arg(array(
        'param1'  => 'paramValue',
        'param2'         => 'paramValue2',
      ), 'https://scriptsrc.com/'),
      null,
      'web'
    );
    // add script to embed wrapper
    $html = "<iframe>" . $html . "<script async src='" . $scriptSrc . "'></script></iframe>";
    return $html;
}

add_filter('instant_articles_social_embed_youtube', 'edit_youtube_embed', 10, 3);

This is of course example code. I was able to log the output of this filter, and it isn't escaped at that point, so its happening after the fact

Can you provide a link to a page which shows this issue?

doyouremember.com/?feed=instant_articles

Look for the youtube wrappers. Any help on this would be greatly appreciated! I love the plugin, and have been banging my head on this for a few hours. I'll gladly contribute if you can point me in the right direction! Maybe it has something to do with the get_content_from_DOM() function?

Technical info

• WordPress version: 4.9.5
• allfacebook Instant Articles version: 0.9.1