am 3534dadd: docs: fix XSS vulnerability in search (5eb80efb) · Commits · e / os / android_frameworks_base

docs/html/search.jd

+11 −3

Original line number	Diff line number	Diff line
		@@ -71,7 +71,7 @@ page.title=Search Results
		// save the tab index from the hash
		tabIndex = location.hash.split("&t=")[1];

		$("#searchTitle").html("search results for <em>" + query + "</em>");
		$("#searchTitle").html("search results for <em>" + escapeHTML(query) + "</em>");
		$.history.add('q=' + query + '&t=' + tabIndex);
		openTab();
		});
		@@ -96,7 +96,8 @@ page.title=Search Results
		$(window).history(function(e, hash) {
		var query = decodeURI(getQuery(hash));
		searchControl.execute(query);
		$("#searchTitle").html("search results for <em>" + query + "</em>");

		$("#searchTitle").html("search results for <em>" + escapeHTML(query) + "</em>");
		});

		// forcefully regain key-up event control (previously jacked by search api)
		@@ -131,6 +132,13 @@ page.title=Search Results
		return queryParts[1];
		}

		/* returns the given string with all HTML brackets converted to entities
		TODO: move this to the site's JS library */
		function escapeHTML(string) {
		return string.replace(/</g,"<")
		.replace(/>/g,">");
		}

		</script>

		<div id="mainBodyFixed" style="width:auto; margin:20px">