fix: add HTMLEscape function to fix XSS attack in search feature (#687)

assets/js/theme.js

@@ -282,7 +282,7 @@ class FixIt {
                 const results = {};
                 window._index.search(query).forEach(({ item, refIndex, matches }) => {
                   let title = item.title;
-                  let content = item.content.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+                  let content = item.content;
                   matches.forEach(({ indices, value, key }) => {
                     if (key === 'content') {
                       content = this._applyHighlightToText(content, indices, highlightTag);
@@ -343,7 +343,7 @@ class FixIt {
           templates: {
             suggestion: ({ title, uri, date, context }) =>
               `<div><a href="${uri}"><span class="suggestion-title">${title}</span></a><span class="suggestion-date">${date}</span></div><div class="suggestion-context">${context}</div>`,
-            empty: ({ query }) => `<div class="search-empty">${searchConfig.noResultsFound}: <span class="search-query">"${query}"</span></div>`,
+            empty: ({ query }) => `<div class="search-empty">${searchConfig.noResultsFound}: <span class="search-query">"${this.util.HTMLEscape(query)}"</span></div>`,
             footer: ({ }) => {
               let searchType, icon, href;
               switch (searchConfig.type) {

assets/js/util.js

@@ -133,4 +133,14 @@ export default class Util {
     }
     return false;
   }
+
+  HTMLEscape(str) {
+    return str.replace(/[&<>"']/g, char => ({
+      '&': '&amp;',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&#39;'
+    })[char]);
+  }
 }

layouts/home.search.json

@@ -55,8 +55,8 @@
                     {{- $anchor = replace (index (split $contentm ">") 0) `"` "" -}}
                     {{- $contentm = printf "<h6 id=%v" $contentm -}}
                   {{- end -}}
-                  {{/* Plainify, unescape and remove (\n, \t) */}}
-                  {{- $contentj = $contentj | plainify | htmlUnescape | replaceRE `[\n\t ]+` " " -}}
+                  {{/* Plainify and remove (\n, \t) */}}
+                  {{- $contentj = $contentj | plainify | replaceRE `[\n\t ]+` " " -}}
                   {{- if gt $.Site.Params.search.contentLength 0 -}}
                     {{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}}
                   {{- end -}}
@@ -80,8 +80,8 @@
           {{- if gt $j 0 -}}
             {{- $contentj = printf "<h3 id=%v" $contentj -}}
           {{- end -}}
-          {{/* Plainify, unescape and remove (\n, \t) */}}
-          {{- $contentj = $contentj | plainify | htmlUnescape | replaceRE `[\n\t ]+` " " -}}
+          {{/* Plainify and remove (\n, \t) */}}
+          {{- $contentj = $contentj | plainify | replaceRE `[\n\t ]+` " " -}}
           {{- if gt $.Site.Params.search.contentLength 0 -}}
             {{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}}
           {{- end -}}