FIX: correctly render html of event title (#623)

This has been lost during the move to glimmer.

---------

Co-authored-by: David Taylor <david@taylorhq.com>

assets/javascripts/discourse/components/discourse-post-event/index.gjs

@@ -4,9 +4,8 @@ import { service } from "@ember/service";
 import { modifier } from "ember-modifier";
 import PluginOutlet from "discourse/components/plugin-outlet";
 import concatClass from "discourse/helpers/concat-class";
+import replaceEmoji from "discourse/helpers/replace-emoji";
 import routeAction from "discourse/helpers/route-action";
-import { emojiUnescape } from "discourse/lib/text";
-import { escapeExpression } from "discourse/lib/utilities";
 import icon from "discourse-common/helpers/d-icon";
 import Creator from "./creator";
 import Dates from "./dates";
@@ -53,9 +52,7 @@ export default class DiscoursePostEvent extends Component {
   }
 
   get eventName() {
-    return emojiUnescape(
+    return this.args.event.name || this.args.event.post.topic.title;
-      escapeExpression(this.args.event.name) || this.args.event.post.topic.title
-    );
   }
 
   get isPublicEvent() {
@@ -86,7 +83,7 @@ export default class DiscoursePostEvent extends Component {
             </div>
             <div class="event-info">
               <span class="name">
-                {{this.eventName}}
+                {{replaceEmoji this.eventName}}
               </span>
               <div class="status-and-creators">
                 <PluginOutlet

spec/system/post_event_spec.rb

@@ -9,10 +9,24 @@ describe "Post event", type: :system do
     SiteSetting.calendar_enabled = true
     SiteSetting.discourse_post_event_enabled = true
     sign_in(admin)
-    visit "/new-topic"
+  end
+
+  it "safely renders event name" do
+    post =
+      PostCreator.create(
+        admin,
+        title: "My test meetup event",
+        raw: "[event name=':cat: <script>alert(1);</script>' start='2222-02-22 00:00']\n[/event]",
+      )
+
+    visit(post.topic.url)
+
+    expect(page).to have_css(".event-info .name img.emoji[title='cat']")
+    expect(page).to have_css(".event-info .name", text: "<script>alert(1);</script>")
   end
 
   it "can create, close, and open an event" do
+    visit "/new-topic"
     title = "My upcoming l33t event"
     tomorrow = (Time.zone.now + 1.day).strftime("%Y-%m-%d")