From 2cb4649acf73ce9a7b6c2b3f707673d89a789f46 Mon Sep 17 00:00:00 2001 From: Jonas Franz Date: Sun, 11 Feb 2018 14:42:28 +0100 Subject: [PATCH] Escape search query (#3486) Signed-off-by: Jonas Franz --- modules/templates/helper.go | 7 +++++++ templates/repo/search.tmpl | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/modules/templates/helper.go b/modules/templates/helper.go index d6be25cebb..3f3d6083f2 100644 --- a/modules/templates/helper.go +++ b/modules/templates/helper.go @@ -27,6 +27,7 @@ import ( "golang.org/x/net/html/charset" "golang.org/x/text/transform" "gopkg.in/editorconfig/editorconfig-core-go.v1" + "html" ) // NewFuncMap returns functions for injecting to templates @@ -179,6 +180,7 @@ func NewFuncMap() []template.FuncMap { return dict, nil }, "Printf": fmt.Sprintf, + "Escape": Escape, }} } @@ -197,6 +199,11 @@ func Str2html(raw string) template.HTML { return template.HTML(markup.Sanitize(raw)) } +// Escape escapes a HTML string +func Escape(raw string) string { + return html.EscapeString(raw) +} + // List traversings the list func List(l *list.List) chan interface{} { e := l.Front() diff --git a/templates/repo/search.tmpl b/templates/repo/search.tmpl index 19a9d4474c..3ddc5de86c 100644 --- a/templates/repo/search.tmpl +++ b/templates/repo/search.tmpl @@ -14,7 +14,7 @@ {{if .Keyword}}

- {{.i18n.Tr "repo.search.results" .Keyword .RepoLink .RepoName | Str2html}} + {{.i18n.Tr "repo.search.results" (.Keyword|Escape) .RepoLink .RepoName | Str2html }}