I'm using the autocomplete (with Solr Terms) route as endpoint in a decoupled architecture. The query parameter allows HTML as input, so if I would inject some HTML in my query but end it with a word that has suggestions, it will also return the user input with HTML in the response.
/search_api_autocomplete/<search_api_autocomplete_search>?q=test<img%20src%3D0%20onerror%3Dalert(document.cookie)>%2012[
{
"value": "test<img src=0 onerror=alert(document.cookie)> 12",
"label": "\n<div class=\"search-api-autocomplete-suggestion\">\n <span class=\"autocomplete-suggestion-user-input\">test<img src=0 onerror=alert(document.cookie)> 12</span> </div>\n"
},
{
"value": "test<img src=0 onerror=alert(document.cookie)> 120",
"label": "\n<div class=\"search-api-autocomplete-suggestion\">\n <span class=\"autocomplete-suggestion-user-input\">test<img src=0 onerror=alert(document.cookie)> 12</span> </div>\n"
},
{
"value": "test<img src=0 onerror=alert(document.cookie)> 125",
"label": "\n<div class=\"search-api-autocomplete-suggestion\">\n <span class=\"autocomplete-suggestion-user-input\">test<img src=0 onerror=alert(document.cookie)> 12</span><span class=\"autocomplete-suggestion-suggestion-suffix\">5</span> </div>\n"
}
]Filter out the HTML on the autocomplete query parameter.
Active
1.0
General code
bojan_dev → changed the visibility of the branch 3484623-the-autocomplete-routeendpoint to hidden.
Discussed privately and concluded that this is just a matter of documenting that the value key is not HTML, so shouldn’t be used as such by custom frontend code.
@bojan_dev: Where would you say is the best place to add this clarification, where do we have the highest chance of reaching frontend developers?