Fix BibTeX citation decoding HTML entities in the HTML appendix (#15212)

The appendix BibTeX block was inserted as HTML, so the parser decoded
entity-like text in the Pandoc output: R\&notebook showed as R\¬ebook
and a\&lt;b as a\<b. The block now holds the text as Pandoc wrote it,
with LF line endings, and the copy button copies the same text.

- Set the BibTeX block with textContent in createCodeBlock, and
  normalize newlines to LF
- Add regression fixtures for entity-like text in titles

Fixes #15210
See #15209

Author: cderv

news/changelog-1.11.md

@@ -83,6 +83,7 @@ All changes included in 1.11:
 - ([#15128](https://github.com/quarto-dev/quarto-cli/pull/15128)): Fix Google Scholar metadata missing references with a YAML bibliography not wrapped in `---` delimiters.
 - ([#15131](https://github.com/quarto-dev/quarto-cli/issues/15131)): Fix the light/dark toggle appearing, with no dark styles to switch to, when the `dark` brand file holds only comments and is ignored.
 - ([#15207](https://github.com/quarto-dev/quarto-cli/issues/15207)): Fix the BibTeX citation in the HTML appendix showing a copy button that does nothing when `code-copy: false` is set.
+- ([#15210](https://github.com/quarto-dev/quarto-cli/issues/15210)): Fix the BibTeX citation in the HTML appendix showing and copying altered text when the title contains text that looks like an HTML entity, such as `<` or `R&notebook`.
 
 ### `pdf`
 

src/format/html/format-html-shared.ts

@@ -30,6 +30,7 @@ import { Document, Element } from "../../core/deno-dom.ts";
 import { normalizePath } from "../../core/path.ts";
 import { formatHasBootstrap } from "./format-html-info.ts";
 import { HtmlFormatFeatureDefaults } from "./format-html-types.ts";
+import { normalizeNewlines } from "../../core/text.ts";
 
 // features that are enabled by default for 'html'. setting
 // all of these to false will yield the minimal html output
@@ -516,7 +517,7 @@ export function createCodeCopyButton(doc: Document, format: Format) {
 
 export function createCodeBlock(
   doc: Document,
-  htmlContents: string,
+  text: string,
   language?: string,
 ) {
   const preEl = doc.createElement("PRE");
@@ -527,7 +528,7 @@ export function createCodeBlock(
   if (language) {
     codeEl.classList.add(language);
   }
-  codeEl.innerHTML = htmlContents;
+  codeEl.textContent = normalizeNewlines(text);
   preEl.appendChild(codeEl);
   return preEl;
 }

tests/docs/smoke-all/2026/10/16/citation-title/bibtex-entity-literals.qmd

@@ -0,0 +1,19 @@
+---
+title: 'Tags a<b and x y'
+author: Jane Doe
+date: 2025-04-30
+citation: true
+appendix-cite-as: [bibtex]
+format: html
+_quarto:
+  tests:
+    html:
+      ensureFileRegexMatches:
+        - ['title = \{Tags a\\<b and x\\ y\}']
+        # Pandoc writes CRLF on Windows; the block must keep LF line endings
+        - ['\r']
+---
+
+The BibTeX appendix block shows the Pandoc biblatex output as text. The title text `a&lt;b` becomes `a\&lt;b` in BibTeX and must not display as `a\<b`; `x&amp;nbsp;y` becomes `x\&amp;nbsp;y` and must not display as `x\&nbsp;y`. These words are not title-cased, so the entity-like sequences stay intact.
+
+Pandoc writes the BibTeX with CRLF line endings on Windows; the block keeps LF line endings like the rest of the page.

tests/docs/smoke-all/2026/10/16/citation-title/entity-literals.qmd

@@ -16,8 +16,9 @@ _quarto:
         matches: ['“Literal &Nbsp; and &Notanentity; and\s+R&notebook and &#123\.”']
         noMatches: [" "]
       ensureFileRegexMatches:
-        # BibTeX title; R&notebook is not asserted there because the block is inserted as HTML, which decodes &not
-        - ['title = \{Literal \\&Nbsp; and \\&Notanentity; and', '\\&\\#123\}']
+        # BibTeX title; R\&notebook must not have its legacy &not decoded to ¬
+        - ['title = \{Literal \\&Nbsp; and \\&Notanentity; and', 'R\\&notebook', '\\&\\#123\}']
+        - ['R\\¬ebook']
 ---
 
 Text that only looks like an HTML entity stays literal in the appendix citation, the BibTeX citation and the Google Scholar metadata: an escaped ` ` is the text ` `, not a no-break space, and an unknown entity or an incomplete reference is not decoded.