fix: remove incorrect processing of CLI params

Fixes #5266

Author: kenjis

system/HTTP/CLIRequest.php

@@ -170,17 +170,17 @@ protected function parseCommand()
                 if ($optionValue) {
                     $optionValue = false;
                 } else {
-                    $this->segments[] = esc(strip_tags($arg));
+                    $this->segments[] = $arg;
                 }
 
                 continue;
             }
 
-            $arg   = esc(strip_tags(ltrim($arg, '-')));
+            $arg   = ltrim($arg, '-');
             $value = null;
 
             if (isset($args[$i + 1]) && mb_strpos($args[$i + 1], '-') !== 0) {
-                $value       = esc(strip_tags($args[$i + 1]));
+                $value       = $args[$i + 1];
                 $optionValue = true;
             }
 

tests/system/HTTP/CLIRequestTest.php

@@ -61,6 +61,30 @@ public function testParsingSegments()
         $this->assertSame($segments, $this->request->getSegments());
     }
 
+    public function testParsingSegmentsWithHTMLMetaChars()
+    {
+        $_SERVER['argv'] = [
+            'index.php',
+            'users',
+            '21',
+            'abc < def',
+            "McDonald's",
+            '<s>aaa</s>',
+        ];
+
+        // reinstantiate it to force parsing
+        $this->request = new CLIRequest(new App());
+
+        $segments = [
+            'users',
+            '21',
+            'abc < def',
+            "McDonald's",
+            '<s>aaa</s>',
+        ];
+        $this->assertSame($segments, $this->request->getSegments());
+    }
+
     public function testParsingOptions()
     {
         $_SERVER['argv'] = [