015613a140
In commit f374478dd, we enabled the possibility to use HTML in the
search results translations in order to add a <strong> tag to these
results. However, that meant we were also allowing HTML tags inside the
search term itself, and so it was possible to inject HTML on the page.
Stripping the HTML tags solves the issue.
Note the issue wasn't a high severity issue because tags such as
`<script>` weren't allowed since we were using the `sanitize` helper.
20 lines
493 B
Ruby
20 lines
493 B
Ruby
class Shared::SearchResultsSummaryComponent < ApplicationComponent
|
|
attr_reader :results, :search_terms, :advanced_search_terms
|
|
|
|
def initialize(results:, search_terms:, advanced_search_terms:)
|
|
@results = results
|
|
@search_terms = search_terms
|
|
@advanced_search_terms = advanced_search_terms
|
|
end
|
|
|
|
private
|
|
|
|
def summary
|
|
sanitize(t(
|
|
"proposals.index.search_results",
|
|
count: results.size,
|
|
search_term: strip_tags(search_terms)
|
|
))
|
|
end
|
|
end
|