From 39909d8c18ede7bb94bbcd0ad00d41b2f545528b Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@ruby-lang.org>
Date: Tue, 7 Sep 2021 23:52:13 +0900
Subject: [ruby/rdoc] Escape search results

https://hackerone.com/reports/1321358

https://github.com/ruby/rdoc/commit/2ebf8fd510
---
 lib/rdoc/generator/template/darkfish/js/darkfish.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib/rdoc/generator/template/darkfish/js/darkfish.js')

diff --git a/lib/rdoc/generator/template/darkfish/js/darkfish.js b/lib/rdoc/generator/template/darkfish/js/darkfish.js
index 111bbf8eb9..d0c9467751 100644
--- a/lib/rdoc/generator/template/darkfish/js/darkfish.js
+++ b/lib/rdoc/generator/template/darkfish/js/darkfish.js
@@ -54,7 +54,7 @@ function hookSearch() {
     var html = '';
 
     // TODO add relative path to <script> per-page
-    html += '<p class="search-match"><a href="' + index_rel_prefix + result.path + '">' + this.hlt(result.title);
+    html += '<p class="search-match"><a href="' + index_rel_prefix + this.escapeHTML(result.path) + '">' + this.hlt(result.title);
     if (result.params)
       html += '<span class="params">' + result.params + '</span>';
     html += '</a>';
-- 
cgit v1.2.3