Commit 743e9cb

authored

fix: escape HTML in search keywords (#2586)

1 parent 5448d93 commit 743e9cbCopy full SHA for 743e9cb

File tree

+33

-13

lines changed

+33

-13

lines changed

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`import { isMobile, mobileBreakpoint } from '../util/env.js';`
`2`	`2`	`import * as dom from '../util/dom.js';`
	`3`	`+import { stripUrlExceptId } from '../router/util.js';`
`3`	`4`
`4`	`5`	`/** @typedef {import('../Docsify.js').Constructor} Constructor */`
`5`	`6`
`@@ -474,6 +475,8 @@ export function Events(Base) {`
`474`	`475`	`return;`
`475`	`476`	`}`
`476`	`477`
	`478`	`+ href = stripUrlExceptId(href);`
	`479`	`+`
`477`	`480`	`const oldActive = dom.find(sidebar, 'li.active');`
`478`	`481`	`const newActive = dom`
`479`	`482`	`.find(`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,7 @@ import {`
`4`	`4`	`getAndRemoveDocsifyIgnoreConfig,`
`5`	`5`	`} from '../utils.js';`
`6`	`6`	`import { slugify } from '../slugify.js';`
	`7`	`+import { stripUrlExceptId } from '../../router/util.js';`
`7`	`8`
`8`	`9`	`export const headingCompiler = ({ renderer, router, compiler }) =>`
`9`	`10`	`(renderer.heading = function ({ tokens, depth }) {`
`@@ -20,7 +21,7 @@ export const headingCompiler = ({ renderer, router, compiler }) =>`
`20`	`21`	`nextToc.ignoreSubHeading = ignoreSubHeading;`
`21`	`22`	`const slug = slugify(config.id \|\| str);`
`22`	`23`	`const url = router.toURL(router.getCurrentPath(), { id: slug });`
`23`		`- nextToc.slug = url;`
	`24`	`+ nextToc.slug = stripUrlExceptId(url);`
`24`	`25`	`compiler.toc.push(nextToc);`
`25`	`26`
`26`	`27`	`// Note: tabindex="-1" allows programmatically focusing on heading`

Lines changed: 16 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -40,6 +40,22 @@ export function stringifyQuery(obj, ignores = []) {`
`40`	`40`	return qs.length ? `?${qs.join('&')}` : '';
`41`	`41`	`}`
`42`	`42`
	`43`	`+export function stripUrlExceptId(str) {`
	`44`	`+ const [path, queryString] = str.split('?');`
	`45`	`+ if (!queryString) {`
	`46`	`+ return str;`
	`47`	`+ }`
	`48`	`+`
	`49`	`+ const params = new URLSearchParams(queryString);`
	`50`	`+ const id = params.get('id');`
	`51`	`+`
	`52`	`+ if (id !== null) {`
	`53`	+ return `${path}?id=${id}`;
	`54`	`+ }`
	`55`	`+`
	`56`	`+ return path;`
	`57`	`+}`
	`58`	`+`
`43`	`59`	`export const isAbsolutePath = cached(path => {`
`44`	`60`	`return /(:\|(\/{2}))/g.test(path);`
`45`	`61`	`});`

Lines changed: 8 additions & 8 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-import { search } from './search.js';`
	`1`	`+import { escapeHtml,search } from './search.js';`
`2`	`2`	`import cssText from './style.css';`
`3`	`3`
`4`	`4`	`let NO_DATA_TEXT = '';`
`@@ -75,11 +75,11 @@ function bindEvents() {`
`75`	`75`	`let timeId;`
`76`	`76`
`77`	`77`	`/**`
`78`		`- Prevent to Fold sidebar.`
`79`		`-`
`80`		`- When searching on the mobile end,`
`81`		`- the sidebar is collapsed when you click the INPUT box,`
`82`		`- making it impossible to search.`
	`78`	`+ * Prevent to Fold sidebar.`
	`79`	`+ *`
	`80`	`+ * When searching on the mobile end,`
	`81`	`+ * the sidebar is collapsed when you click the INPUT box,`
	`82`	`+ * making it impossible to search.`
`83`	`83`	`*/`
`84`	`84`	`Docsify.dom.on(`
`85`	`85`	`$search,`
`@@ -129,10 +129,10 @@ export function init(opts, vm) {`
`129`	`129`	`return;`
`130`	`130`	`}`
`131`	`131`
`132`		`- const keywords = vm.router.parse().query.s;`
	`132`	`+ const keywords = vm.router.parse().query.s\|\|'';`
`133`	`133`
`134`	`134`	`Docsify.dom.style(cssText);`
`135`		`- tpl(vm, keywords);`
	`135`	`+ tpl(vm, escapeHtml(keywords));`
`136`	`136`	`bindEvents();`
`137`	`137`	`keywords && setTimeout(_ => doSearch(keywords), 500);`
`138`	`138`	`}`

Lines changed: 4 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,7 @@ import {`
`5`	`5`	`import { markdownToTxt } from './markdown-to-txt.js';`
`6`	`6`	`import Dexie from 'dexie';`
`7`	`7`
`8`		`-let INDEXES = {};`
	`8`	`+let INDEXES = [];`
`9`	`9`
`10`	`10`	`const db = new Dexie('docsify');`
`11`	`11`	`db.version(1).stores({`
`@@ -48,7 +48,7 @@ function resolveIndexKey(namespace) {`
`48`	`48`	`: LOCAL_STORAGE.INDEX_KEY;`
`49`	`49`	`}`
`50`	`50`
`51`		`-function escapeHtml(string) {`
	`51`	`+exportfunction escapeHtml(string) {`
`52`	`52`	`const entityMap = {`
`53`	`53`	`'&': '&',`
`54`	`54`	`'<': '<',`
`@@ -102,7 +102,7 @@ function getListData(token) {`
`102`	`102`	`export function genIndex(path, content = '', router, depth, indexKey) {`
`103`	`103`	`const tokens = window.marked.lexer(content);`
`104`	`104`	`const slugify = window.Docsify.slugify;`
`105`		`- const index = {};`
	`105`	`+ const index = [];`
`106`	`106`	`let slug;`
`107`	`107`	`let title = '';`
`108`	`108`
`@@ -299,7 +299,7 @@ export async function init(config, vm) {`
`299`	`299`	`INDEXES = await getData(indexKey);`
`300`	`300`
`301`	`301`	`if (isExpired) {`
`302`		`- INDEXES = {};`
	`302`	`+ INDEXES = [];`
`303`	`303`	`} else if (!isAuto) {`
`304`	`304`	`return;`
`305`	`305`	`}`

Comments

(0)