After upgrading from 4.7 to 4.8, I noticed the autocomplete search results are showing & instead of &.

The node title is "Places & Things"

I'm using a view to populate the search results.

Let me know if there is any other information I can provide.

CommentFileSizeAuthor
#14 search_autocomplete-encode_html_autocomplete_suggestions-3007746-14.patch1.39 KBdom.
#12 search_autocomplete-encode_html_autocomplete_suggestions-3007746-11.patch707 bytesdom.
#4 search_autocomplete-encode_html_autocomplete_suggestions-3007746-4.patch1.54 KBdom.

Comments

gmclelland created an issue. See original summary.

Dirkozoid’s picture

Dirkozoid commented

Hi @gmclelland,

check my comment here and apply the patch. I had the same problem yesterday.

https://www.drupal.org/project/search_autocomplete/issues/1739852#commen...

gmclelland’s picture

gmclelland commented

Thanks for the suggestion @Dirkozoid, but the patch doesn't apply to the latest 7.4.x-dev version.

dom.’s picture

dom. commented
Status: Active » Needs review
StatusFileSize
new search_autocomplete-encode_html_autocomplete_suggestions-3007746-4.patch1.54 KB

Damn... I did not see this new issue and submitted patch at #1739852: Getting encoded HTML for special characters in autocomplete suggestions.
OK, let's start fresh. Here is the patch again here.

Status: Needs review » Needs work

The last submitted patch, 4: search_autocomplete-encode_html_autocomplete_suggestions-3007746-4.patch, failed testing. View results

  • Dom. committed e66e163 on 7.x-4.x 
    Issue #3007746 by Dom.: Autocomplete results show & instead of &
dom.’s picture

dom. commented
Status: Needs work » Fixed
gmclelland’s picture

gmclelland commented

Thank you Dom that did fix the problem with the autocomplete results, but I noticed another place where it is still showing &. If you watch the search input, it changes values as a visitor uses the up or down arrow keys to select different autocomplete results.

Steps to reproduce:
- Focus a search input.
- Type the search term. Autocomplete results show.
- Press the down key a few times and watch as the search input changes it's value inside the search box. That value will then show the encoded characters we don't want.

Hope that helps

dom.’s picture

dom. commented

I just spent an hour on this... Don't seems like fixable to me, unless we don't sent data encoded in the JSON. But... we go back to security issue.
The method to override is :
$.ui.autocomplete.prototype._move
but it is not even supposed to be an extension point. Therefore the necessary element within the method are not accessible (that I know of)...
For moment, I don't know how to fix #8 otherwise than disable the keyUp / keyDown

gmclelland’s picture

gmclelland commented

Thank you trying. Not being that familiar with jquery.ui.autocomplete, I started looking into it.

Probably a long shot, but I wonder if https://github.com/scottgonzalez/jquery-ui-extensions/blob/master/src/au... would help?

In the docs it say's:
If you want the label to be treated as html you can use Scott González' html extension.

gmclelland’s picture

gmclelland commented

I'm not sure, but maybe we should escape the characters like & right after it is received from the ajax call instead of inside the _renderItem function?

Idea from https://stackoverflow.com/a/19305075/484832

Don't seems like fixable to me, unless we don't sent data encoded in the JSON. But... we go back to security issue.

I would think for it to be valid JSON all those special characters would need to be encoded?

dom.’s picture

dom. commented
StatusFileSize
new search_autocomplete-encode_html_autocomplete_suggestions-3007746-11.patch707 bytes

To be honest, the "jQuery UI Autocomplete HTML Extension" is about having HTML displayed in the suggestions. The code shows the same kind of trick I used to have the fields rendering (ie override $.ui.autocomplete.prototype), which is the sense of the demo in the project:
https://github.com/scottgonzalez/jquery-ui-extensions/blob/master/demo/a...

I spend again some more time and figured out. Once you know the solution, it makes you cry how simple it actually was...
Please try out this patch and let me know.

gmclelland’s picture

gmclelland commented

So close.. I tested the patch and it does fix the encoding of the text inside the search input, but if you hit the down key and then enter key on a result item that is focused with a node title of special "test" & <script>alert('hello')</script> it will execute it and show a javascript alert.

One thing I noticed is that the the autocomplete result item doesn't show the <script> tags, but the search input does.

dom.’s picture

dom. commented
Status: Fixed » Needs review
StatusFileSize
new search_autocomplete-encode_html_autocomplete_suggestions-3007746-14.patch1.39 KB

This so frustrating ! But we are getting closer.
New patch attached for you to try !

Status: Needs review » Needs work

The last submitted patch, 14: search_autocomplete-encode_html_autocomplete_suggestions-3007746-14.patch, failed testing. View results

gmclelland’s picture

gmclelland commented
Status: Needs work » Reviewed & tested by the community

Just tested your patch. You fixed it Dom! Great job.

I guess it's time for new release?

The last submitted patch, 12: search_autocomplete-encode_html_autocomplete_suggestions-3007746-11.patch, failed testing. View results

  • Dom. committed efc19b0 on 7.x-4.x 
    Issue #3007746 by Dom.: Autocomplete results show &amp; instead of &
dom.’s picture

dom. commented
Status: Reviewed & tested by the community » Fixed
Dirkozoid’s picture

Dirkozoid commented

Thank you!

gmclelland’s picture

gmclelland commented

Really appreciate your help Dom. Thanks again

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.