jandieman/searxng
2
0
Fork 0
mirror of https://github.com/searxng/searxng.git synced 2026-08-20 06:01:24 +00:00
Code Issues Projects Releases Wiki Activity

[fix] calculator: XSS from innerHTML (#6551)

Browse Source 
* [fix] calculator: XSS from innerHTML

* [build] /static
This commit is contained in:
Brock Vojkovic
2026-08-19 20:09:02 +08:00
committed by GitHub
parent 374939b888
commit 5ffd32ca2f
6 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
client/simple/src/js/plugin/Calculator.ts
View File

@@ -80,7 +80,12 @@ export default class Calculator extends Plugin {
try {
const node = Calculator.math.parse(searchInput.value);
return `${node.toString()} = ${node.evaluate()}`;
const value = node.evaluate();
if (typeof value !== "number") {
return;
}
return `${node.toString()} = ${value}`;
} catch {
// not a compatible math expression
return;

2
client/simple/src/js/util/appendAnswerElement.ts
View File

@@ -23,7 +23,7 @@ export const appendAnswerElement = (element: HTMLElement | string | number): voi
if (!(element instanceof HTMLElement)) {
const span = document.createElement("span");
span.innerHTML = element.toString();
span.textContent = element.toString();
// biome-ignore lint/style/noParameterAssign: TODO
element = span;
}