From 855fc9c9c85720b5e0c6b9086083165492e2a864 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Thu, 16 Jul 2026 17:15:54 +0200
Subject: Construct DOM elements using escaping helpers to prevent XSS

---
 public/javascripts/admin_search.js   | 30 ++++++++++++++----------------
 public/javascripts/related_assets.js |  9 +++------
 2 files changed, 17 insertions(+), 22 deletions(-)

(limited to 'public/javascripts')

diff --git a/public/javascripts/admin_search.js b/public/javascripts/admin_search.js
index 7604bb7..d135503 100644
--- a/public/javascripts/admin_search.js
+++ b/public/javascripts/admin_search.js
@@ -72,24 +72,20 @@ function initSearchPicker(options) {
           found = false;
           for (var i = 0; i < data.length; i++) {
             (function(node) {
-              var link;
+              var anchor = $("<a>").attr("href", onSelect ? "#" : node.node_path);
+              anchor.append(document.createTextNode(node.title || ""));
+              anchor.append($("<span>", { "class": "result_path" }).text(node.unique_name || ""));
+              var link = $("<p>").append(anchor);
+
               if (onSelect) {
-                link = $(
-                  "<p><a href='#'>" + node.title +
-                    "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-                );
-                link.find("a").bind("click", function() {
+                anchor.bind("click", function() {
                   onSelect(node);
                   results.slideUp();
                   results.empty();
                   return false;
                 });
-              } else {
-                link = $(
-                  "<p><a href='" + node.node_path + "'>" + node.title +
-                    "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-                );
               }
+
               results.append(link);
               found = true;
             })(data[i]);
@@ -150,7 +146,9 @@ dashboard_search = {
           results.append("<p class='search_group_label'>Tags</p>");
           var tag_row = $("<div class='search_tag_row'></div>");
           data.tags.forEach(function(tag) {
-            tag_row.append("<a class='search_tag_pill' href='" + tag.tag_path + "'>" + tag.name + "</a>");
+            tag_row.append(
+              $("<a>", { "class": "search_tag_pill" }).attr("href", tag.tag_path).text(tag.name || "")
+            );
             found = true;
           });
           results.append(tag_row);
@@ -159,10 +157,10 @@ dashboard_search = {
         if (data.nodes.length) {
           results.append("<p class='search_group_label'>Pages</p>");
           data.nodes.forEach(function(node) {
-            results.append(
-              "<p><a href='" + node.node_path + "'>" + node.title +
-                "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-            );
+            var anchor = $("<a>").attr("href", node.node_path);
+            anchor.append(document.createTextNode(node.title || ""));
+            anchor.append($("<span>", { "class": "result_path" }).text(node.unique_name || ""));
+            results.append($("<p>").append(anchor));
             found = true;
           });
         }
diff --git a/public/javascripts/related_assets.js b/public/javascripts/related_assets.js
index 803332f..3340fa7 100644
--- a/public/javascripts/related_assets.js
+++ b/public/javascripts/related_assets.js
@@ -15,12 +15,9 @@ related_assets = {
       renderResults: function(data, results) {
         var found = false;
         data.forEach(function(asset) {
-          var item = $(
-            "<a href='#' class='related_asset_result'>" +
-              "<img src='" + asset.thumb_url + "' alt=''>" +
-              "<span>" + asset.name + "</span>" +
-            "</a>"
-          );
+          var item = $("<a>", { href: "#", "class": "related_asset_result" });
+          item.append($("<img>", { src: asset.thumb_url, alt: "" }));
+          item.append($("<span>").text(asset.name || ""));
           item.bind("click", function() {
             related_assets.attach(asset.id, createUrl, list);
             return false;
-- 
cgit v1.3