Escape HTML characters in web search query before displaying in UI

yamnikov-oleg · Feb 4, 2017 · 00e2d4f · 00e2d4f
1 parent 649f50e
commit 00e2d4f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/launch_entry.go b/launch_entry.go
@@ -137,7 +137,7 @@ func NewWebSearchEntry(q string) *LaunchEntry {
 		Type:       WebSearchEntry,
 		Icon:       Config.WebSearch.Icon,
 		Name:       q,
-		MarkupName: fmt.Sprintf("Search for: <b>%v</b>", q),
+		MarkupName: fmt.Sprintf("Search for: <b>%v</b>", EscapeHTML(q)),
 		TabName:    q,
 		Cmdline:    "xdg-open " + fmt.Sprintf(Config.WebSearch.Engine, url.QueryEscape(q)),
 	}

diff --git a/util.go b/util.go
@@ -18,6 +18,13 @@ func EscapeAmpersand(s string) string {
 	return strings.Replace(s, "&", "&amp;", -1)
 }
 
+func EscapeHTML(s string) string {
+	s = strings.Replace(s, "&", "&amp;", -1)
+	s = strings.Replace(s, "<", "&lt;", -1)
+	s = strings.Replace(s, ">", "&gt;", -1)
+	return s
+}
+
 func ExpandEnvVars(query string) string {
 	matches := EnvVarRegexp.FindAllStringSubmatch(query, -1)
 	for _, match := range matches {