From 99f24eb59840cd479bc59c5fc19e48acd24106cb Mon Sep 17 00:00:00 2001
From: Veloman Yunkan <veloman.yunkan@gmail.com>
Date: Mon, 12 Dec 2022 17:12:24 +0400
Subject: [PATCH] Safe href in suggestion links

---
 static/skin/viewer.js | 9 ++++++++-
 test/server.cpp       | 4 ++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/static/skin/viewer.js b/static/skin/viewer.js
index b37c95ee6..10e8b48d9 100644
--- a/static/skin/viewer.js
+++ b/static/skin/viewer.js
@@ -342,7 +342,14 @@ function setupSuggestions() {
           } else {
             searchLink = `${root}/search?content=${encodeURIComponent(currentBook)}&pattern=${encodeURIComponent(htmlDecode(data.value.value))}`;
           }
-          item.innerHTML = `<a class="suggest" href="javascript:gotoUrl('${searchLink}')">${htmlDecode(data.value.label)}</a>`;
+          const jsAction = `gotoUrl('${searchLink}')`;
+          // Values of the href attribute are assumed by the browser to be
+          // fully URI-encoded (no matter what the scheme is). Therefore, in
+          // order to prevent the browser from decoding the URI-encoded parts
+          // of searchLink we have to URI-encode a second time.
+          // (see https://stackoverflow.com/questions/33721510)
+          const jsActionURIEncoded = encodeURIComponent(jsAction);
+          item.innerHTML = `<a class="suggest" href="javascript:${jsActionURIEncoded}">${htmlDecode(data.value.label)}</a>`;
         },
         highlight: "autoComplete_highlight",
         selected: "autoComplete_selected"
diff --git a/test/server.cpp b/test/server.cpp
index 072233d45..d110707c5 100644
--- a/test/server.cpp
+++ b/test/server.cpp
@@ -69,7 +69,7 @@ const ResourceCollection resources200Compressible{
   { DYNAMIC_CONTENT, "/ROOT/skin/taskbar.css" },
   { STATIC_CONTENT,  "/ROOT/skin/taskbar.css?cacheid=216d6b5d" },
   { DYNAMIC_CONTENT, "/ROOT/skin/viewer.js" },
-  { STATIC_CONTENT,  "/ROOT/skin/viewer.js?cacheid=51e745c2" },
+  { STATIC_CONTENT,  "/ROOT/skin/viewer.js?cacheid=0933a233" },
   { DYNAMIC_CONTENT, "/ROOT/skin/fonts/Poppins.ttf" },
   { STATIC_CONTENT,  "/ROOT/skin/fonts/Poppins.ttf?cacheid=af705837" },
   { DYNAMIC_CONTENT, "/ROOT/skin/fonts/Roboto.ttf" },
@@ -291,7 +291,7 @@ R"EXPECTEDRESULT(                                <img src="../skin/download.png?
       /* url */ "/ROOT/viewer",
 R"EXPECTEDRESULT(    <link type="text/css" href="./skin/taskbar.css?cacheid=216d6b5d" rel="Stylesheet" />
     <link type="text/css" href="./skin/css/autoComplete.css?cacheid=08951e06" rel="Stylesheet" />
-    <script type="text/javascript" src="./skin/viewer.js?cacheid=51e745c2" defer></script>
+    <script type="text/javascript" src="./skin/viewer.js?cacheid=0933a233" defer></script>
     <script type="text/javascript" src="./skin/autoComplete.min.js?cacheid=1191aaaf"></script>
       const blankPageUrl = root + "/skin/blank.html?cacheid=6b1fa032";
             <label for="kiwix_button_show_toggle"><img src="./skin/caret.png?cacheid=22b942b4" alt=""></label>