fix: search highlight (#2410)

* fix: search highlight

* wip

app/javascript/js/controllers/search_controller.js

@@ -3,6 +3,7 @@ import * as Mousetrap from 'mousetrap'
 import { Controller } from '@hotwired/stimulus'
 import { Turbo } from '@hotwired/turbo-rails'
 import { autocomplete } from '@algolia/autocomplete-js'
+import { sanitize } from 'dompurify'
 import URI from 'urijs'
 import debouncePromise from '../helpers/debounce_promise'
 
@@ -21,11 +22,11 @@ export default class extends Controller {
     'visibleLabel',
     'clearValue',
     'clearButton',
-  ];
+  ]
 
-  debouncedFetch = debouncePromise(fetch, this.searchDebounce);
+  debouncedFetch = debouncePromise(fetch, this.searchDebounce)
 
-  destroyMethod;
+  destroyMethod
 
   get dataset() {
     return this.autocompleteTarget.dataset
@@ -157,15 +158,29 @@ export default class extends Controller {
             )
           }
 
-          const labelChildren = [item._label]
+          const label = sanitize(item._label)
+
+          const labelChildren = [
+            createElement(
+              'div',
+              {
+                dangerouslySetInnerHTML: { __html: label },
+              },
+              label,
+            ),
+          ]
+
           if (item._description) {
+            const description = sanitize(item._description)
+
             labelChildren.push(
               createElement(
                 'div',
                 {
                   class: 'aa-ItemDescription',
+                  dangerouslySetInnerHTML: { __html: description },
                 },
-                item._description,
+                description,
               ),
             )
           }