XML responses with & in URLs "broken"

While testing a new API I had the problem that the XML response contains a URL which itself contains a URL:

<httpActionLink> 
    <url>https://server.com?token=123456&amp;redirectUrl=%2Fpath%2Fpage.jsf</url> 
</httpActionLink>

the &amp; is the encoding needed in XML, but Postman does not change it back to &

So when I “Follow the link” (ctrl + click), the browser opens the first URL, but then the redirection to redirectUrl is not working!

When I change it manually to …&redirectUrl… it works.

Any suggestions? Should Postman “decode” the &amp; in XML?

oh, there is an open github issue from 2022:

the textual description of the issue suffers also from the &amp; Problem (but the additional screenshots explain it in detail):

When I use the api to generate a URL that contains an “&” character, this is output as “&” when the response-body is displayed in the “pretty-view” or “raw-view”.

The second “&” should be “&amp;”

Maybe that’s why the issue is still open?