From 536e0b171e05376031fcc743897e78bf490d03ee Mon Sep 17 00:00:00 2001
From: Cell <1024@lruihao.cn>
Date: Fri, 16 Jan 2026 20:02:22 +0800
Subject: [PATCH] fix: add HTMLEscape function to fix XSS attack in search
 feature (#687)

---
 assets/js/theme.js       |  4 ++--
 assets/js/util.js        | 10 ++++++++++
 layouts/home.search.json |  8 ++++----
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/assets/js/theme.js b/assets/js/theme.js
index de1bdac3..e7310c92 100644
--- a/assets/js/theme.js
+++ b/assets/js/theme.js
@@ -282,7 +282,7 @@ class FixIt {
                 const results = {};
                 window._index.search(query).forEach(({ item, refIndex, matches }) => {
                   let title = item.title;
-                  let content = item.content.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+                  let content = item.content;
                   matches.forEach(({ indices, value, key }) => {
                     if (key === 'content') {
                       content = this._applyHighlightToText(content, indices, highlightTag);
@@ -343,7 +343,7 @@ class FixIt {
           templates: {
             suggestion: ({ title, uri, date, context }) =>
               `<div><a href="${uri}"><span class="suggestion-title">${title}</span></a><span class="suggestion-date">${date}</span></div><div class="suggestion-context">${context}</div>`,
-            empty: ({ query }) => `<div class="search-empty">${searchConfig.noResultsFound}: <span class="search-query">"${query}"</span></div>`,
+            empty: ({ query }) => `<div class="search-empty">${searchConfig.noResultsFound}: <span class="search-query">"${this.util.HTMLEscape(query)}"</span></div>`,
             footer: ({ }) => {
               let searchType, icon, href;
               switch (searchConfig.type) {
diff --git a/assets/js/util.js b/assets/js/util.js
index 57c9344e..9c24cf03 100644
--- a/assets/js/util.js
+++ b/assets/js/util.js
@@ -133,4 +133,14 @@ export default class Util {
     }
     return false;
   }
+
+  HTMLEscape(str) {
+    return str.replace(/[&<>"']/g, char => ({
+      '&': '&amp;',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&#39;'
+    })[char]);
+  }
 }
diff --git a/layouts/home.search.json b/layouts/home.search.json
index f0907ace..048f0ea5 100644
--- a/layouts/home.search.json
+++ b/layouts/home.search.json
@@ -55,8 +55,8 @@
                     {{- $anchor = replace (index (split $contentm ">") 0) `"` "" -}}
                     {{- $contentm = printf "<h6 id=%v" $contentm -}}
                   {{- end -}}
-                  {{/* Plainify, unescape and remove (\n, \t) */}}
-                  {{- $contentj = $contentj | plainify | htmlUnescape | replaceRE `[\n\t ]+` " " -}}
+                  {{/* Plainify and remove (\n, \t) */}}
+                  {{- $contentj = $contentj | plainify | replaceRE `[\n\t ]+` " " -}}
                   {{- if gt $.Site.Params.search.contentLength 0 -}}
                     {{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}}
                   {{- end -}}
@@ -80,8 +80,8 @@
           {{- if gt $j 0 -}}
             {{- $contentj = printf "<h3 id=%v" $contentj -}}
           {{- end -}}
-          {{/* Plainify, unescape and remove (\n, \t) */}}
-          {{- $contentj = $contentj | plainify | htmlUnescape | replaceRE `[\n\t ]+` " " -}}
+          {{/* Plainify and remove (\n, \t) */}}
+          {{- $contentj = $contentj | plainify | replaceRE `[\n\t ]+` " " -}}
           {{- if gt $.Site.Params.search.contentLength 0 -}}
             {{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}}
           {{- end -}}