fix(search-pad): prevent HTML injection

Given the apprioritate title and search text HTML injection was possible until now.
bpmn-io · Jun 12, 2019 · 777fa06 · 777fa06
1 parent b724111
commit 777fa06
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/lib/features/search-pad/SearchPad.js b/lib/features/search-pad/SearchPad.js
@@ -11,6 +11,9 @@ import {
   getBBox as getBoundingBox
 } from '../../util/Elements';
 
+import {
+  escapeHTML
+} from '../../util/EscapeUtil';
 
 /**
  * Provides searching infrastructure
@@ -507,9 +510,9 @@ function createHtmlText(tokens) {
 
   tokens.forEach(function(t) {
     if (t.matched) {
-      htmlText += '<strong class="' + SearchPad.RESULT_HIGHLIGHT_CLASS + '">' + t.matched + '</strong>';
+      htmlText += '<strong class="' + SearchPad.RESULT_HIGHLIGHT_CLASS + '">' + escapeHTML(t.matched) + '</strong>';
     } else {
-      htmlText += t.normal;
+      htmlText += escapeHTML(t.normal);
     }
   });