"DOM text reinterpreted as HTML" security issue fixed

DogukanUrker · Jan 17, 2024 · ebf69c2 · ebf69c2
1 parent 94df3ba
commit ebf69c2
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 10 deletions.
diff --git a/static/standardUI/js/navbar.js b/static/standardUI/js/navbar.js
@@ -1,10 +1,13 @@
 function search() {
-  var input = document.getElementById("searchInput").value;
-  if (input === "" || input.replace(/\s/g, "") === "") {
+  const input = document.querySelector("#searchInput").value;
+  if (input === "" || input.trim() === "") {
   } else {
-    window.location.href = `/search/${input.replace(/\s/g, "+")}`;
+    window.location.href = `/search/${encodeURIComponent(
+      escape(input.trim())
+    )}`;
   }
 }
+
 function hamburger() {
   document.getElementById("hamburgerDropdown").classList.toggle("show");
 }

diff --git a/static/standardUI/js/searchBar.js b/static/standardUI/js/searchBar.js
@@ -1,8 +1,9 @@
 function searchBar() {
-  var input = document.querySelector("#searchBarInput").value;
-  console.log(input);
-  if (input === "" || input.replace(/\s/g, "") === "") {
+  const input = document.querySelector("#searchBarInput").value;
+  if (input === "" || input.trim() === "") {
   } else {
-    window.location.href = `/search/${input.replace(/\s/g, "+")}`;
+    window.location.href = `/search/${encodeURIComponent(
+      escape(input.trim())
+    )}`;
   }
 }
diff --git a/static/tailwindUI/js/navbar.js b/static/tailwindUI/js/navbar.js
@@ -1,10 +1,13 @@
 function search() {
-  var input = document.getElementById("searchInput").value;
-  if (input === "" || input.replace(/\s/g, "") === "") {
+  const input = document.querySelector("#searchInput").value;
+  if (input === "" || input.trim() === "") {
   } else {
-    window.location.href = `/search/${input.replace(/\s/g, "+")}`;
+    window.location.href = `/search/${encodeURIComponent(
+      escape(input.trim())
+    )}`;
   }
 }
+
 function hamburger() {
   document.getElementById("hamburgerDropdown").classList.toggle("show");
 }