MAGEDOC-2656: fix XSS in search on devdocs

Eugene Bannykh · Eugene Bannykh · commit 897913588e80 · 2017-10-31T19:27:15.000+02:00
diff --git a/_layouts/search.html b/_layouts/search.html
@@ -22,7 +22,7 @@
 </div>
 
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/instantsearch.js/1/instantsearch.min.css">
-<script src="https://cdn.jsdelivr.net/instantsearch.js/1/instantsearch.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/instantsearch.js@1/dist/instantsearch.min.js"></script>
 
 <script>
 
@@ -33,6 +33,11 @@
     urlSync: true
   });
 
+  function escapeHtml(str) {
+    var div = document.createElement('div');
+    div.appendChild(document.createTextNode(str));
+    return div.innerHTML;
+  }
 
   function app(opts) {
     var switcher = document.getElementsByClassName('version-switcher')[0];
@@ -91,9 +96,8 @@
 
             return '<div class="hit"><h2 class="hit-name">'+ link + '</h2><div class="hit-url">'+ document.location.origin + url +'</div><div class="hit-content">'+ item._highlightResult.text.value + '</div></div>';
           },
-          empty: function ( query ) {
-            return '<div id="no-results-message"><p>No results for the search <em>"' + query.query +'"</em>.</p></div>';
-          },
+          empty: '<div id="no-results-message"><p>No results found.</p></div>',
+
         },
       })
     );
@@ -105,6 +109,7 @@
     );
 
 
+
     search.addWidget(
       instantsearch.widgets.refinementList({
         container: '#tags',
