Add an html escaping instead of a striping html tags

Author: voronkovich

app/Resources/assets/js/jquery.instantSearch.js

@@ -20,7 +20,6 @@
     };
 
     var defaultConfig = {
-        allowedTags: '',
         minQueryLength: 2,
         maxPreviewItems: 10,
         previewDelay: 500,
@@ -38,35 +37,11 @@
         };
     }
 
-    function isValidUrl(url) {
-        var parser = document.createElement('a');
-        try {
-            parser.href = url;
-            return !!parser.hostname;
-        } catch (e) {
-            return false;
-        }
-    }
-
-    // See http://phpjs.org/functions/strip_tags/
-    function stripTags(input, allowed) {
-        allowed = (((allowed || '') + '').toLowerCase().match(/<[a-z][a-z0-9]*>/g) || []).join('');
-
-        var tags = /<\/?([a-z][a-z0-9]*)\b[^>]*>/gi;
-        var commentsAndPhpTags = /<!--[\s\S]*?-->|<\?(?:php)?[\s\S]*?\?>/gi;
-
-        return input.replace(commentsAndPhpTags, '').replace(tags, function($0, $1) {
-            return allowed.indexOf('<' + $1.toLowerCase() + '>') > -1 ? $0 : '';
-        });
-    }
-
     var initInstantSearch = function(el, config) {
         var $input = $(el);
         var $form = $input.closest('form');
         var $preview = $('<ul class="search-preview list-group"></ul>').appendTo($form);
 
-        config.noItemsFoundMessage = stripTags(config.noItemsFoundMessage);
-
         var setPreviewItems = function(items) {
             $preview.empty();
 
@@ -80,44 +55,36 @@
         }
 
         var addItemToPreview = function(item) {
-            $preview.append('<li class="list-group-item"><a href="' + item.url + '">' + item.result + '</a></li>');
+            var $link = $('<a>').attr('href', item.url).text(item.result);
+            var $li = $('<li class="list-group-item">').append($link);
+
+            $preview.append($li);
         }
 
         var noItemsFound = function() {
+            var $li = $('<li class="list-group-item">').text(config.noItemsFoundMessage);
+
             $preview.empty();
-            $preview.append('<li class="list-group-item">' + config.noItemsFoundMessage + '</li>');
+            $preview.append($li);
         }
 
         var updatePreview = function() {
-            if ($input.val().length < config.minQueryLength) {
+            var query = $.trim($input.val()).replace(/\s{2,}/g, ' ');
+            if (query.length < config.minQueryLength) {
                 $preview.empty();
                 return;
             }
 
             $.getJSON($form.attr('action') + '?' + $form.serialize(), function(items) {
-                // Sanitize items
-                var sanitizedItems = [];
-                $.each(items, function(index, item) {
-                    // Url can contains a 'javascript:' code
-                    if (isValidUrl(item.url)) {
-                        sanitizedItems.push({
-                            url: item.url,
-                            result: stripTags(item.result, config.allowedTags)
-                        });
-                    }
-                });
-
-                if (sanitizedItems.length === 0) {
+                if (items.length === 0) {
                     noItemsFound();
                     return;
                 }
 
-                setPreviewItems(sanitizedItems);
+                setPreviewItems(items);
             });
         }
 
-        var debouncedUpdatePreview = debounce(updatePreview, config.previewDelay);
-
         $input.focusout(function(e) {
             $preview.fadeOut();
         });
@@ -127,8 +94,6 @@
             updatePreview();
         });
 
-        $input.keyup(function(e) {
-            debouncedUpdatePreview();
-        });
+        $input.keyup(debounce(updatePreview, config.previewDelay));
     }
 })(window.jQuery);

src/AppBundle/Controller/BlogController.php

@@ -155,8 +155,7 @@ public function searchAction(Request $request)
 
         foreach ($posts as $post) {
             array_push($results, array(
-                // We should never trust to admin user
-                'result' => strip_tags($post->getTitle()),
+                'result' => htmlspecialchars($post->getTitle()),
                 'url' => $this->generateUrl('blog_post', array('slug' => $post->getSlug())),
             ));
         }