quartz-community/search
1
0
Fork 0
mirror of https://github.com/quartz-community/search.git synced 2026-07-22 02:50:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: sanitize search result innerHTML to prevent XSS

Browse source
This commit is contained in:
saberzero1 2026-05-24 16:21:07 +02:00
parent f63b8957e6
commit d0b64d99ea
No known key found for this signature in database
5 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
dist/components/index.js vendored
View file

File diff suppressed because one or more lines are too long

2
dist/components/index.js.map vendored
View file

File diff suppressed because one or more lines are too long

2
dist/index.js vendored
View file

File diff suppressed because one or more lines are too long

2
dist/index.js.map vendored
View file

File diff suppressed because one or more lines are too long

12
src/components/scripts/search.inline.ts
View file

@ -325,19 +325,25 @@ async function setupSearch() {
const titleEl = document.createElement("h3");
titleEl.className = "card-title";
titleEl.innerHTML = item.title;
titleEl.textContent = item.title;
itemTile.appendChild(titleEl);
if (item.tags.length > 0) {
const tagList = document.createElement("ul");
tagList.className = "tags";
tagList.innerHTML = item.tags.join("");
tagList.textContent = "";
for (const tag of item.tags) {
const li = document.createElement("li");
li.textContent = tag.replace(/<[^>]*>/g, "");
tagList.appendChild(li);
}
itemTile.appendChild(tagList);
}
const descEl = document.createElement("p");
descEl.className = "card-description";
descEl.innerHTML = item.content;
// Sanitize content but preserve <mark> tags from search highlighting
descEl.innerHTML = item.content.replace(/<(?!\/?mark\b)[^>]*>/gi, "");
itemTile.appendChild(descEl);
results.appendChild(itemTile);