HTML escape all lines of the search result (gogs#3402)

Fixes gogs#3383.
ethantkoenig · Jan 22, 2018 · d644e88 · d644e88
1 parent 00d0847
commit d644e88
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/modules/search/search.go b/modules/search/search.go
@@ -6,6 +6,7 @@ package search
 
 import (
 	"bytes"
+	"html"
 	gotemplate "html/template"
 	"strings"
 
@@ -75,17 +76,17 @@ func searchResult(result *indexer.RepoSearchResult, startIndex, endIndex int) (*
 			closeActiveIndex := util.Min(result.EndIndex-index, len(line))
 			err = writeStrings(&formattedLinesBuffer,
 				`<li>`,
-				line[:openActiveIndex],
+				html.EscapeString(line[:openActiveIndex]),
 				`<span class='active'>`,
-				line[openActiveIndex:closeActiveIndex],
+				html.EscapeString(line[openActiveIndex:closeActiveIndex]),
 				`</span>`,
-				line[closeActiveIndex:],
+				html.EscapeString(line[closeActiveIndex:]),
 				`</li>`,
 			)
 		} else {
 			err = writeStrings(&formattedLinesBuffer,
 				`<li>`,
-				line,
+				html.EscapeString(line),
 				`</li>`,
 			)
 		}