Javascript Remoting returning JSON with encoded characters. For example &amp

Question

I have an @remoteaction method that returns a list of custom objects and respective child objects. On client I am using AngularJS to display this array. Since it's a remoteaction Salesforce will automatically return the response as JSON, no need to serialize. My challenge is that the response contains encoded characters. For example, ampersands are getting returned as &amp, I need just the ampersand. My JSON payload can be fairly large at times so I am reluctant to do a lot of extra processing to replace these encoded characters with their decoded values. Is there a way to simply and efficiently pass the JSON without the encoded characters?

Here is my remote method

@remoteaction
global static List<DealerPlanning__c> getDealerPlans(String year)
{
    List<DealerPlanning__c>dpList = [SELECT id, name,Account__r.name,Account__r.Aw__c,Account__r.Site,ApprovalStatus__c,ApprovalStatusWithQuarter__c,ApprovalRejectionDate__c, planyear__c,CountofInitiatives__c,
                                            QualityAndExecution__c,BusinessObjective__c,Strengths__c,Weaknesses__c,Opportunities__c, Threats__c,Rating__c,
                                            (SELECT id, name,Initiative_Name__c,Status__c,TargetStartMonth__c,Initiative_Details__c,TargetMonthNumber__c,Dealer_Planning__r.ApprovalStatus__c
                                        FROM Dealer_Initiatives__r)
                                    FROM DealerPlanning__c  
                                    WHERE Account__r.ownerid=:userinfo.getUserId()
                                        AND planyear__c =:year];

    return dpList;
}

Here is the method call

var initDealerPlans = function()
    {
        Ctlr_DealerPlanWorkspace.getDealerPlans('2016',
        function(result, event) 
        {
            if (event.status) 
            {
                console.dir(result);
                $scope.dealerPlans = result;
                $scope.planYear = '2016';
                $scope.$apply();
            }
        });
    }
    initDealerPlans();

Here is sample output.

Any assistance would be greatly appreciated.

Thank you

Jason

Answer 1

The RemoteAction framework auto-escapes the results by default, to prevent accidental XSS injections for developers using innerHTML to render the contents of a callback. This is a security feature, and should not be disabled without considering the consequences.

However, most frameworks, such as AngularJS, also have a built-in auto-escaping feature that prevents XSS injections, meaning that it is not necessary to have the RemoteAction framework escape the results for you. In order for everything to come out looking just right, while not having any security vulnerabilities, you only ever need exactly one auto-escape function active at one time.

When you are using a framework that has auto-escape features, you need to set the escape=false for the remoting method so the text is not escaped:

var initDealerPlans = function()
    {
        Ctlr_DealerPlanWorkspace.getDealerPlans('2016',
        function(result, event) 
        {
            if (event.status) 
            {
                console.dir(result);
                $scope.dealerPlans = result;
                $scope.planYear = '2016';
                $scope.$apply();
            }
        }, {escape : false};
    }

https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_js_remoting_configuring_request.htm

escape - boolean - Whether to escape the Apex method’s response. The default is true.