Cross-Site Scripting (XSS) in search function

[six-two]

Hi,

I started using mkdocs for personal pentesting notes. Today I noticed, that searching for certain pages caused XSS payloads in some code listings to be triggered. I have created a minimum example at https://github.com/six-two/mkdocs-xss-via-search . While this is not really a security issue (since only the authors of the documentation can create malicious code blocks), I still recommend fixing it.

Steps to reproduce

First clone and serve the repo:

git clone https://github.com/six-two/mkdocs-xss-via-search
cd mkdocs-xss-via-search/
mkdocs serve

Then visit the page at http://127.0.0.1:8000/.
Finally search for xss to trigger the popup (see screenshot).

Version info

I updated to the latest version with pip install --upgrade mkdocs:

$ pip freeze | grep mkdocs
mkdocs==1.2.3