Fixed invalid escaping of HTML in search results

This commit is contained in:
squidfunk 2021-08-24 18:33:42 +02:00
parent 702de82585
commit 829820a239
8 changed files with 13 additions and 99 deletions

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

View File

@ -196,7 +196,7 @@
"base": base_url, "base": base_url,
"features": features, "features": features,
"translations": {}, "translations": {},
"search": "assets/javascripts/workers/search.709b4209.min.js" | url, "search": "assets/javascripts/workers/search.409db549.min.js" | url,
"version": config.extra.version or None "version": config.extra.version or None
} -%} } -%}
{%- set translations = app.translations -%} {%- set translations = app.translations -%}
@ -223,7 +223,7 @@
</script> </script>
{% endblock %} {% endblock %}
{% block scripts %} {% block scripts %}
<script src="{{ 'assets/javascripts/bundle.56838a2c.min.js' | url }}"></script> <script src="{{ 'assets/javascripts/bundle.56a63758.min.js' | url }}"></script>
{% for path in config["extra_javascript"] %} {% for path in config["extra_javascript"] %}
<script src="{{ path | url }}"></script> <script src="{{ path | url }}"></script>
{% endfor %} {% endfor %}

View File

@ -83,7 +83,7 @@ export function mountSearchHiglight(
) )
]) ])
.pipe( .pipe(
map(([index, url]) => setupSearchHighlighter(index.config)( map(([index, url]) => setupSearchHighlighter(index.config, true)(
url.searchParams.get("h")! url.searchParams.get("h")!
)), )),
map(fn => { map(fn => {

View File

@ -167,7 +167,7 @@ export class Search {
/* Set up document map and highlighter factory */ /* Set up document map and highlighter factory */
this.documents = setupSearchDocumentMap(docs) this.documents = setupSearchDocumentMap(docs)
this.highlight = setupSearchHighlighter(config) this.highlight = setupSearchHighlighter(config, false)
/* Set separator for tokenizer */ /* Set separator for tokenizer */
lunr.tokenizer.separator = new RegExp(config.separator) lunr.tokenizer.separator = new RegExp(config.separator)

View File

@ -54,11 +54,12 @@ export type SearchHighlightFactoryFn = (query: string) => SearchHighlightFn
* Create a search highlighter * Create a search highlighter
* *
* @param config - Search index configuration * @param config - Search index configuration
* @param escape - Whether to escape HTML
* *
* @returns Search highlight factory function * @returns Search highlight factory function
*/ */
export function setupSearchHighlighter( export function setupSearchHighlighter(
config: SearchIndexConfig config: SearchIndexConfig, escape: boolean
): SearchHighlightFactoryFn { ): SearchHighlightFactoryFn {
const separator = new RegExp(config.separator, "img") const separator = new RegExp(config.separator, "img")
const highlight = (_: unknown, data: string, term: string) => { const highlight = (_: unknown, data: string, term: string) => {
@ -79,8 +80,12 @@ export function setupSearchHighlighter(
})`, "img") })`, "img")
/* Highlight string value */ /* Highlight string value */
return value => escapeHTML(value) return value => (
.replace(match, highlight) escape
.replace(/<\/mark>(\s+)<mark[^>]*>/img, "$1") ? escapeHTML(value)
: value
)
.replace(match, highlight)
.replace(/<\/mark>(\s+)<mark[^>]*>/img, "$1")
} }
} }