Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not processing text containing html tags properly #16932

Open
cfx1 opened this issue Aug 17, 2016 · 2 comments · May be fixed by #17189
Open

Not processing text containing html tags properly #16932

cfx1 opened this issue Aug 17, 2016 · 2 comments · May be fixed by #17189

Comments

@cfx1
Copy link

cfx1 commented Aug 17, 2016

Adding an item containing html tags to the list, such as the text: Text escaping: <xyz>tag</xyz> will yield incorrect suggestions.

Setup

<input id="myinput" />
<script>
    var input = document.getElementById("myinput");
    new Awesomplete(input, {
        minChars: 1,
        list: ["Text escaping: <xyz>tag</xyz>"]
    });
</script>

or

<input class="awesomplete" data-list="#mylist" data-minchars="1" />
<ul id="mylist">
    <li>Text escaping: &lt;xyz&gt;tag&lt;/xyz&gt;</li>
</ul>

Results

Typing the letter 't' in the input box will give the following incorrect suggestion (missing the <xyz> and </xyz> that was surrounding the word 'tag'):
image

Typing the letter 'x' in the input box will give the following incorrect suggestion (notice the missing '<' after the word "tag" in the suggestion):
image

@ArthurHoaro
Copy link

I have a similar issue. It looks like awesomplete interprets HTML within suggestions.
Is there a setting to prevent this behavior and keep the tags escaped properly?

Note that <script> tags are properly escaped.

@LeaVerou
Copy link
Owner

I don't believe so. I would be willing to merge a PR on this, since it can also be a security issue.

dontcallmedom added a commit to dontcallmedom/awesomplete that referenced this issue Jun 26, 2019
>
> fix LeaVerou#16932
>
> Generate manual DOM subtree for each marked instance of the queried string instead of generating an unsafe HTML string
@dontcallmedom dontcallmedom linked a pull request Jun 26, 2019 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants