Block Layout & Place Block pages are unsafe due to XSS vulnerabilities in title and category fields

larowlan → credited plopesc → .

Created a initial patch for this that solves the initial issue, but could escape strings twice, like in the failing test.

Tests fails because views provided blocks have the following admin_label:

$admin_label = new TranslatableMarkup('@view: @display', ['@view' => $view->label(), '@display' => $display->display['display_title']]);

That means that malicious values in the view or display names are already escaped in advance.
However, an admin_label where the malicious part is not in a token, like the one below, should be escaped:

new TranslatableMarkup("<script>alert('XSS subject');</script>")

As far as I know, we don't have a reliable way to determine whether a string has been already escaped to determine if a second escape is necessary or not.

In the current scenario, I'm not sure whether it's better to allow XSS unsafe strings, or have double escaped ones for views. Any of the scenarios is unlikely to happen.

If someone has a better approach to solve this situation, any advice is much appreciated.