In onebox, `&` become `&`

To me it isn’t a bug at all. The URL is being shown in the correct format.