Androidmanifest invalid ampersand after patching

[ext4xfs]

Attempting to use apk-mitm on https://apkpure.com/myhyundai-with-bluelink/com.stationdm.bluelink. It seems that apk-mitm is modifying & in the androidManifest.xml with & which breaks xml and causes apktool to fail.

npx apk-mitm --apktool /root/apktool-cli-all.jar MyHyundai\ with\ Bluelink_5.2.0_Apkpure.xapk

  ╭ apk-mitm v1.2.1
  ├ apktool custom version
  ╰ uber-apk-signer v1.2.1

  Using temporary directory:
  /tmp/apk-mitm-0e4f966c75beceb6ec6d8fbb2ec13ee2

  ✔ Extracting APKs
  ✔ Finding base APK path
  ❯ Patching base APK
    ✔ Checking prerequisities
    ✔ Decoding APK file
    ✔ Applying patches
    ❯ Encoding patched APK file
      ↓ Encoding using AAPT2 [skipped]
        → Failed, falling back to AAPT...
      ✖ Encoding using AAPT [fallback]
        → I: Building resources...
      Signing patched APK file
    Signing APKs
    Compressing APKs

   Failed!  An error occurred:

I: Using Apktool v2.9.2-29-36760ac2-SNAPSHOT with 16 thread(s).
I: Checking whether sources has changed...
I: Checking whether sources has changed...
I: Checking whether sources has changed...
[Fatal Error] :260:66: The entity name must immediately follow the '&' in the entity reference.
I: Checking whether resources has changed...
I: Building resources...
W: <tmp_dir>/base-apk/decode/AndroidManifest.xml:260: error: not well-formed (invalid token).
brut.androlib.exceptions.AndrolibException: brut.common.BrutException: could not exec (exit code = 1): [/tmp/brut_util_Jar_12921895477762158763809261697661603206.tmp, link, -o, /tmp/APKTOOL11962471146413763123.tmp, --package-id, 127, --min-sdk-version, 31, --target-sdk-version, 33, --version-code, 50071, --version-name, 5.2.0, --no-auto-version, --no-version-vectors, --no-version-transitions, --no-resource-deduping, --allow-reserved-package-id, --no-compile-sdk-metadata, --warn-manifest-validation, -e, /tmp/APKTOOL13178998841966025774.tmp, -0, arsc, -I, <tmp_dir>/framework/1.apk, --manifest, <tmp_dir>/base-apk/decode/AndroidManifest.xml, <tmp_dir>/base-apk/decode/build/resources.zip]

  The full logs of all commands are available here:
  /tmp/apk-mitm-0e4f966c75beceb6ec6d8fbb2ec13ee2/logs

vs with skip-patches I see that the invalid lines in the patched version use & in the working:

 npx apk-mitm --apktool /root/apktool-cli-all.jar MyHyundai\ with\ Bluelink_5.2.0_Apkpure.xapk --wait --skip-patches

  ╭ apk-mitm v1.2.1
  ├ apktool custom version
  ╰ uber-apk-signer v1.2.1

  Using temporary directory:
  /tmp/apk-mitm-47cb3ecba8da6521518d6b391a17f5fc

  ✔ Extracting APKs
  ✔ Finding base APK path
  ✔ Patching base APK
  ✔ Signing APKs
  ✔ Compressing APKs

   Done!  Patched file: ./MyHyundai with Bluelink_5.2.0_Apkpure-patched.xapk

When I manually try to fix it with --wait, the app will not start (is unrelated, the unpatched version also crashes).

        <receiver android:exported="true" android:label="Remote & Car Finder" android:name="com.stationdm.bluelink.kotlin.ui.widget.Remote4X1Widget">
            <intent-filter>
                <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_ALL"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_LOGOUT"/>
            </intent-filter>
            <meta-data android:name="android.appwidget.provider" android:resource="@xml/remote4_x1_widget_info"/>
        </receiver>
        <receiver android:exported="true" android:label="Remote & POI Search" android:name="com.stationdm.bluelink.kotlin.ui.widget.Remote4X2Widget">
            <intent-filter>
                <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_ALL"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_LOGOUT"/>
            </intent-filter>
            <meta-data android:name="android.appwidget.provider" android:resource="@xml/remote4_x2_widget_info"/>
        </receiver>

vs what it should be

        <receiver android:exported="true" android:label="Remote &amp; Car Finder" android:name="com.stationdm.bluelink.kotlin.ui.widget.Remote4X1Widget">
            <intent-filter>
                <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_ALL"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_LOGOUT"/>
            </intent-filter>
            <meta-data android:name="android.appwidget.provider" android:resource="@xml/remote4_x1_widget_info"/>
        </receiver>
        <receiver android:exported="true" android:label="Remote &amp; POI Search" android:name="com.stationdm.bluelink.kotlin.ui.widget.Remote4X2Widget">
            <intent-filter>
                <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_ALL"/>
                <action android:name="com.stationdm.bluelink.widget.UPDATE_LOGOUT"/>
            </intent-filter>
            <meta-data android:name="android.appwidget.provider" android:resource="@xml/remote4_x2_widget_info"/>
        </receiver>