diff --git a/assets/js/theme.js b/assets/js/theme.js index 72dcd691..3cf17281 100644 --- a/assets/js/theme.js +++ b/assets/js/theme.js @@ -30,6 +30,12 @@ class Util { if (!reserved) element.addEventListener('animationend', handler, false); } + escapeHTML(str) { + const div = document.createElement('div'); + div.textContent = str; + return div.innerHTML; + } + } class Theme { @@ -319,10 +325,18 @@ class Theme { title, date, context - }) => `
${title}${date}
${context}
`, + }, { + query + }) => { + const safeQuery = this.util.escapeHTML(query); + return `
${title}${date}
${context}
`; + }, empty: ({ query - }) => `
${searchConfig.noResultsFound}: "${query}"
`, + }) => { + const safeQuery = this.util.escapeHTML(query); + return `
${searchConfig.noResultsFound}: "${safeQuery}"
`; + }, footer: ({}) => { const { searchType, diff --git a/src/js/theme.js b/src/js/theme.js index c45cfee5..0cd06eca 100644 --- a/src/js/theme.js +++ b/src/js/theme.js @@ -26,6 +26,12 @@ class Util { }; if (!reserved) element.addEventListener('animationend', handler, false); } + + escapeHTML(str) { + const div = document.createElement('div'); + div.textContent = str; + return div.innerHTML; + } } class Theme { @@ -272,8 +278,14 @@ class Theme { } }, templates: { - suggestion: ({ title, date, context }) => `
${title}${date}
${context}
`, - empty: ({ query }) => `
${searchConfig.noResultsFound}: "${query}"
`, + suggestion: ({ title, date, context }, { query }) => { + const safeQuery = this.util.escapeHTML(query); + return `
${title}${date}
${context}
`; + }, + empty: ({ query }) => { + const safeQuery = this.util.escapeHTML(query); + return `
${searchConfig.noResultsFound}: "${safeQuery}"
`; + }, footer: ({}) => { const { searchType, icon, href } = searchConfig.type === 'algolia' ? { searchType: 'algolia',