From 887ec1764a2c6ff9685820226b1999fb2a997a3f Mon Sep 17 00:00:00 2001
From: David Huard <huard.david@ouranos.ca>
Date: Tue, 14 Nov 2023 16:01:55 -0500
Subject: [PATCH 1/2] Escape HTML characters in the indicator search variable
 tooltip.

---
 CHANGES.rst               |  1 +
 docs/_static/indsearch.js | 26 ++++++++++++++++----------
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 2cdfedfac..038356f1a 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -13,6 +13,7 @@ New features and enhancements
 Bug fixes
 ^^^^^^^^^
 * Fixed a bug with ``n_escore=-1`` in ``xclim.sdba.adjustment.NpdfTransform`` (:issue:`1515`, :pull:`1515`).
+* In the documentaion, fix the tooltips in the indicator search results (:issue:`1524`, :pull:`1527`).
 
 Internal changes
 ^^^^^^^^^^^^^^^^
diff --git a/docs/_static/indsearch.js b/docs/_static/indsearch.js
index d657a63f4..2bc9771fb 100644
--- a/docs/_static/indsearch.js
+++ b/docs/_static/indsearch.js
@@ -30,15 +30,18 @@ fetch('indicators.json')
   });
 
 
-// Populate list of variables
-//function getVariables() {
-//    fetch('variables.json')
-//        .then((res) => {
-//            return res.json();
-//        })
-//}
-//const variables = getVariables();
-
+function escapeHTML(str){
+    /* Escape HTML characters in a string. */
+    var map =
+    {
+        '&': '&amp;',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#039;'
+    };
+    return str.replace(/[&<>"']/g, function(m) {return map[m];});
+}
 
 function makeKeywordLabel(ind) {
     /* Print list of keywords only if there is at least one. */
@@ -55,7 +58,10 @@ function makeKeywordLabel(ind) {
 function makeVariableList(ind) {
     /* Print list of variables and include mouse-hover tooltip with variable description. */
     return Object.entries(ind.vars).map((kv) => {
-        const tooltip = `<button class="indVarname" title="${kv[1]}" alt="${kv[1]}">${kv[0]}</button>`;
+        /* kv[0] is the variable name, kv[1] is the variable description. */
+        /* Convert kv[1] to a string literal */
+        const text = escapeHTML(kv[1]);
+        const tooltip = `<button class="indVarname" title="${text}" alt="${text}">${kv[0]}</button>`;
         return tooltip
     }).join('');
 }

From 20376922e9e68a00be446610ab015567d0238a21 Mon Sep 17 00:00:00 2001
From: David Huard <huard.david@ouranos.ca>
Date: Thu, 16 Nov 2023 15:04:22 -0500
Subject: [PATCH 2/2] Apply escapeHTML to title and abstract as well

---
 docs/_static/indsearch.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/_static/indsearch.js b/docs/_static/indsearch.js
index 2bc9771fb..fe1d1f0a7 100644
--- a/docs/_static/indsearch.js
+++ b/docs/_static/indsearch.js
@@ -72,13 +72,13 @@ function indTemplate(ind) {
   return `
     <div class="indElem" id="${ind.id}">
       <div class="indHeader">
-        <b class="indTitle">${ind.title}</b>
+        <b class="indTitle">${escapeHTML(ind.title)}</b>
         <a class="reference_internal indName" href="api_indicators.html#xclim.indicators.${ind.module}.${ind.name}" title="${ind.name}">
           <code>${ind.module}.${ind.name}</code>
         </a>
       </div>
       <div class="indVars">Uses: ${varlist}</div>
-      <div class="indDesc"><p>${ind.abstract}</p></div>
+      <div class="indDesc"><p>${escapeHTML(ind.abstract)}</p></div>
       ${makeKeywordLabel(ind)}
       <div class="indID">Yaml ID: <code>${ind.id}</code></div>
     </div>