blogs/FixIt
1
0
Fork 0
mirror of https://github.com/hugo-fixit/FixIt.git synced 2026-08-24 15:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: add HTMLEscape function to fix XSS attack in search feature (#687)

Browse Source
This commit is contained in:
Cell
2026-01-16 20:02:22 +08:00
committed by GitHub
parent 03f3500c35
commit 536e0b171e
3 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/js/theme.js
+2 -2
View File
@@ -282,7 +282,7 @@ class FixIt {
const results = {}; const results = {};
window._index.search(query).forEach(({ item, refIndex, matches }) => { window._index.search(query).forEach(({ item, refIndex, matches }) => {
let title = item.title; let title = item.title;
let content = item.content.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;') let content = item.content;
matches.forEach(({ indices, value, key }) => { matches.forEach(({ indices, value, key }) => {
if (key === 'content') { if (key === 'content') {
content = this._applyHighlightToText(content, indices, highlightTag); content = this._applyHighlightToText(content, indices, highlightTag);
@@ -343,7 +343,7 @@ class FixIt {
templates: { templates: {
suggestion: ({ title, uri, date, context }) => suggestion: ({ title, uri, date, context }) =>
`<div><a href="${uri}"><span class="suggestion-title">${title}</span></a><span class="suggestion-date">${date}</span></div><div class="suggestion-context">${context}</div>`, `<div><a href="${uri}"><span class="suggestion-title">${title}</span></a><span class="suggestion-date">${date}</span></div><div class="suggestion-context">${context}</div>`,
empty: ({ query }) => `<div class="search-empty">${searchConfig.noResultsFound}: <span class="search-query">"${query}"</span></div>`, empty: ({ query }) => `<div class="search-empty">${searchConfig.noResultsFound}: <span class="search-query">"${this.util.HTMLEscape(query)}"</span></div>`,
footer: ({ }) => { footer: ({ }) => {
let searchType, icon, href; let searchType, icon, href;
switch (searchConfig.type) { switch (searchConfig.type) {
assets/js/util.js
+10
View File
@@ -133,4 +133,14 @@ export default class Util {
} }
return false; return false;
} }
HTMLEscape(str) {
return str.replace(/[&<>"']/g, char => ({
'&': '&amp;',
'<': '&lt;',
'>': '&gt;',
'"': '&quot;',
"'": '&#39;'
})[char]);
}
} }
layouts/home.search.json
+4 -4
View File
@@ -55,8 +55,8 @@
{{- $anchor = replace (index (split $contentm ">") 0) `"` "" -}} {{- $anchor = replace (index (split $contentm ">") 0) `"` "" -}}
{{- $contentm = printf "<h6 id=%v" $contentm -}} {{- $contentm = printf "<h6 id=%v" $contentm -}}
{{- end -}} {{- end -}}
{{/* Plainify, unescape and remove (\n, \t) */}} {{/* Plainify and remove (\n, \t) */}}
{{- $contentj = $contentj | plainify | htmlUnescape | replaceRE `[\n\t ]+` " " -}} {{- $contentj = $contentj | plainify | replaceRE `[\n\t ]+` " " -}}
{{- if gt $.Site.Params.search.contentLength 0 -}} {{- if gt $.Site.Params.search.contentLength 0 -}}
{{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}} {{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}}
{{- end -}} {{- end -}}
@@ -80,8 +80,8 @@
{{- if gt $j 0 -}} {{- if gt $j 0 -}}
{{- $contentj = printf "<h3 id=%v" $contentj -}} {{- $contentj = printf "<h3 id=%v" $contentj -}}
{{- end -}} {{- end -}}
{{/* Plainify, unescape and remove (\n, \t) */}} {{/* Plainify and remove (\n, \t) */}}
{{- $contentj = $contentj | plainify | htmlUnescape | replaceRE `[\n\t ]+` " " -}} {{- $contentj = $contentj | plainify | replaceRE `[\n\t ]+` " " -}}
{{- if gt $.Site.Params.search.contentLength 0 -}} {{- if gt $.Site.Params.search.contentLength 0 -}}
{{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}} {{- $contentj = substr $contentj 0 $.Site.Params.search.contentLength -}}
{{- end -}} {{- end -}}