🐛 Fix: unencoded Content in Search Leads to JavaScript Execution Risk in autocomplete-js

Fixes #416
2026-08-24 15:28:57 +00:00 · 2024-04-25 10:46:55 +08:00
parent 1ed0acdf35
commit f4e8babd12
1 changed files with 1 additions and 1 deletions
@@ -233,7 +233,7 @@ class FixIt {
                const results = {};
                window._index.search(query).forEach(({ item, refIndex, matches }) => {
                  let title = item.title;
-                  let content = item.content;
+                  let content = item.content.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
                  matches.forEach(({ indices, value, key }) => {
                    if (key === 'content') {
                      let offset = 0;