Result of escapeCSS is incorrect if the escaped character is followed by a number

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.2.10 EE GA1, 7.0.1 CE GA2, Master
• Fix Version/s: 6.2.X EE, 7.0.0 DXP FP1, 7.0.2 CE GA3, 7.0.0 DXP SP1, 7.0.3 CE GA4, 7.1.X, Master
• Component/s: Application Security
• Labels:
  • QA-CT
  • backend_test
  • liferay-digital-enterprise-70-sp1
  • liferay-fixpack-de-1-7010
  • liferay-fixpack-portal-164-6210
  • liferay-fixpack-portal-165-6210
• Branch Version/s:
  7.0.x, 6.2.x
• Backported to Branch:
  Committed
• Story Points: 1
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/40992

<style type="text/css">
h1:before {
    content: "<%= HtmlUtil.escapeCSS("'1") %>";
}
</style>
<h1>Hello World</h1>

Expected result
'1Hello World
Actual result
ɱHello World

The problem is ' is escaped to \27. However, the next character is 1. So you end up with \271, which is different character.