fix: escape HTML in search keywords (#2586)

Author: sy-records

src/core/event/index.js

@@ -1,5 +1,6 @@
 import { isMobile, mobileBreakpoint } from '../util/env.js';
 import * as dom from '../util/dom.js';
+import { stripUrlExceptId } from '../router/util.js';
 
 /** @typedef {import('../Docsify.js').Constructor} Constructor */
 
@@ -474,6 +475,8 @@ export function Events(Base) {
         return;
       }
 
+      href = stripUrlExceptId(href);
+
       const oldActive = dom.find(sidebar, 'li.active');
       const newActive = dom
         .find(

src/core/render/compiler/heading.js

@@ -4,6 +4,7 @@ import {
   getAndRemoveDocsifyIgnoreConfig,
 } from '../utils.js';
 import { slugify } from '../slugify.js';
+import { stripUrlExceptId } from '../../router/util.js';
 
 export const headingCompiler = ({ renderer, router, compiler }) =>
   (renderer.heading = function ({ tokens, depth }) {
@@ -20,7 +21,7 @@ export const headingCompiler = ({ renderer, router, compiler }) =>
     nextToc.ignoreSubHeading = ignoreSubHeading;
     const slug = slugify(config.id || str);
     const url = router.toURL(router.getCurrentPath(), { id: slug });
-    nextToc.slug = url;
+    nextToc.slug = stripUrlExceptId(url);
     compiler.toc.push(nextToc);
 
     // Note: tabindex="-1" allows programmatically focusing on heading

src/core/router/util.js

@@ -40,6 +40,22 @@ export function stringifyQuery(obj, ignores = []) {
   return qs.length ? `?${qs.join('&')}` : '';
 }
 
+export function stripUrlExceptId(str) {
+  const [path, queryString] = str.split('?');
+  if (!queryString) {
+    return str;
+  }
+
+  const params = new URLSearchParams(queryString);
+  const id = params.get('id');
+
+  if (id !== null) {
+    return `${path}?id=${id}`;
+  }
+
+  return path;
+}
+
 export const isAbsolutePath = cached(path => {
   return /(:|(\/{2}))/g.test(path);
 });

src/plugins/search/component.js

@@ -1,4 +1,4 @@
-import { search } from './search.js';
+import { escapeHtml, search } from './search.js';
 import cssText from './style.css';
 
 let NO_DATA_TEXT = '';
@@ -75,11 +75,11 @@ function bindEvents() {
   let timeId;
 
   /**
-    Prevent to Fold sidebar.
-
-    When searching on the mobile end,
-    the sidebar is collapsed when you click the INPUT box,
-    making it impossible to search.
+   * Prevent to Fold sidebar.
+   *
+   * When searching on the mobile end,
+   * the sidebar is collapsed when you click the INPUT box,
+   * making it impossible to search.
    */
   Docsify.dom.on(
     $search,
@@ -129,10 +129,10 @@ export function init(opts, vm) {
     return;
   }
 
-  const keywords = vm.router.parse().query.s;
+  const keywords = vm.router.parse().query.s || '';
 
   Docsify.dom.style(cssText);
-  tpl(vm, keywords);
+  tpl(vm, escapeHtml(keywords));
   bindEvents();
   keywords && setTimeout(_ => doSearch(keywords), 500);
 }

src/plugins/search/search.js

@@ -5,7 +5,7 @@ import {
 import { markdownToTxt } from './markdown-to-txt.js';
 import Dexie from 'dexie';
 
-let INDEXES = {};
+let INDEXES = [];
 
 const db = new Dexie('docsify');
 db.version(1).stores({
@@ -48,7 +48,7 @@ function resolveIndexKey(namespace) {
     : LOCAL_STORAGE.INDEX_KEY;
 }
 
-function escapeHtml(string) {
+export function escapeHtml(string) {
   const entityMap = {
     '&': '&',
     '<': '&lt;',
@@ -102,7 +102,7 @@ function getListData(token) {
 export function genIndex(path, content = '', router, depth, indexKey) {
   const tokens = window.marked.lexer(content);
   const slugify = window.Docsify.slugify;
-  const index = {};
+  const index = [];
   let slug;
   let title = '';
 
@@ -299,7 +299,7 @@ export async function init(config, vm) {
   INDEXES = await getData(indexKey);
 
   if (isExpired) {
-    INDEXES = {};
+    INDEXES = [];
   } else if (!isAuto) {
     return;
   }