In onebox, `&` become `&`

Maybe you should URL encode the ampersands in a URL context?

&   :arrow_right:   %26