coreui / coreui-pro / 28759634324

95%

push

github

fix(Autocomplete): escape option labels in highlight to prevent XSS (#593)

Option labels passed to highlightOptionsOnSearch were wrapped in <strong>
and written to innerHTML without escaping, so external-search results
containing markup (e.g. <img src=x onerror=...>) executed. The regex was
also built from the raw search string, throwing on '(' / '[' and enabling
ReDoS. Escape the search for the RegExp and HTML-escape every label segment
before wrapping matches.

2784 of 3071 branches covered (90.65%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 1 file covered. (100.0%)

7166 of 7442 relevant lines covered (96.29%)

707.59 hits per line