3 Commits

Author SHA1 Message Date
dependabot[bot]
3c1f68c59e [upd] github-actions: Bump docker/scout-action from 1.18.2 to 1.20.2 (#5854)
Bumps [docker/scout-action](https://github.com/docker/scout-action) from 1.18.2 to 1.20.2.
- [Release notes](https://github.com/docker/scout-action/releases)
- [Commits](f8c7768240...1128f02d1e)

---
updated-dependencies:
- dependency-name: docker/scout-action
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-13 14:09:07 +01:00
Renaud Allard
23fb76f08f Fix XSS via unsafe rendering of untrusted external data in templates (#5826)
Remove |safe filter from 6 template locations where data from external
search engine APIs was rendered as raw HTML without sanitization. Jinja2
autoescape now properly escapes these fields.

The |safe filter was originally added in commit 213041adc (March 2021)
by copying the pattern from result.title|safe and result.content|safe.
However, title and content are pre-escaped via escape() in webapp.py
lines 704-706 before highlight_content() adds trusted <span> tags for
search term highlighting. The metadata, info.value, link.url_label,
repository, and filename fields never go through any escaping and flow
directly from external API responses to the template.

Affected templates and their untrusted data sources:
- macros.html: result.metadata from DuckDuckGo, Reuters, Presearch,
  Podcast Index, Fyyd, bpb, moviepilot, mediawiki, and others
- paper.html: result.metadata from academic search engines
- map.html: info.value and link.url_label from OpenStreetMap
  user-contributed extratags
- code.html: result.repository and result.filename from GitHub API

Example exploit: a search engine API returning
metadata='<img src=x onerror=alert(document.cookie)>' would execute
arbitrary JavaScript in every user's browser viewing that result.
2026-03-13 13:28:31 +01:00
github-actions[bot]
867a43ac1f [l10n] update translations from Weblate (#5857)
7bbad1a8d - 2026-03-10 - omeritzics <omeritzics@noreply.codeberg.org>
68a483eec - 2026-03-08 - Stephan-P <stephan-p@noreply.codeberg.org>

Co-authored-by: searxng-bot <searxng-bot@users.noreply.github.com>
2026-03-13 12:43:21 +01:00
9 changed files with 40 additions and 34 deletions

View File

@@ -29,7 +29,7 @@ jobs:
persist-credentials: "false"
- name: Sync GHCS from Docker Scout
uses: docker/scout-action@f8c776824083494ab0d56b8105ba2ca85c86e4de # v1.18.2
uses: docker/scout-action@1128f02d1e60f339af7306e0e62b9fdc13d9fab9 # v1.20.2
with:
organization: "searxng"
dockerhub-user: "${{ secrets.DOCKER_USER }}"

View File

@@ -41,7 +41,7 @@
{%- if result.length and not result.thumbnail %}<div class="result_length">{{ _('Length') }}: {{ result.length }}</div>{% endif -%}
{%- if result.views %}<div class="result_views">{{ _('Views') }}: {{ result.views }}</div>{% endif -%}
{%- if result.author %}<div class="result_author">{{ _('Author') }}: {{ result.author }}</div>{% endif -%}
{%- if result.metadata %}<div class="highlight">{{ result.metadata|safe }}</div>{% endif -%}
{%- if result.metadata %}<div class="highlight">{{ result.metadata }}</div>{% endif -%}
{%- endmacro -%}
<!-- Draw result sub footer -->

View File

@@ -11,7 +11,7 @@
{%- if result.repository -%}
<p class="content">{{- '' -}}
{{ _('Repository') }}: {{- ' ' -}}
<a href="{{ result.repository|safe }}"{{- ' ' -}}
<a href="{{ result.repository }}"{{- ' ' -}}
{% if results_on_new_tab %}
target="_blank" {{- ' ' -}}
rel="noopener noreferrer"
@@ -26,7 +26,7 @@
{%- if result.filename %}
<p class="content">
{{ _('Filename') }}: {{ result.filename|safe }}
{{ _('Filename') }}: {{ result.filename }}
</p>
{% endif -%}

View File

@@ -32,10 +32,10 @@
</tr>
{%- endif %}
{%- for info in result.data -%}
<tr><th scope="row">{{ info.label }}</th><td>{{ info.value|safe }}</td></tr>
<tr><th scope="row">{{ info.label }}</th><td>{{ info.value }}</td></tr>
{%- endfor -%}
{%- for link in result.links -%}
<tr><th scope="row">{{ link.label }}</th><td><a class="text-info cursor-pointer" href="{{ link.url }}">{{ link.url_label|safe }}</a></td></tr>
<tr><th scope="row">{{ link.label }}</th><td><a class="text-info cursor-pointer" href="{{ link.url }}">{{ link.url_label }}</a></td></tr>
{%- endfor -%}
</table>

View File

@@ -84,7 +84,7 @@
{%- endif -%}
{%- if result.metadata %}
<div class="highlight">{{ result.metadata|safe }}</div>
<div class="highlight">{{ result.metadata }}</div>
{% endif -%}
<p class="altlink">

View File

@@ -23,21 +23,23 @@
# RoyBarina <roybarina@users.noreply.translate.codeberg.org>, 2025.
# ngf <ngf@noreply.codeberg.org>, 2025.
# return42 <return42@noreply.codeberg.org>, 2025.
# omeritzics <omeritzics@noreply.codeberg.org>, 2026.
msgid ""
msgstr ""
"Project-Id-Version: searx\n"
"Project-Id-Version: searx\n"
"Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
"POT-Creation-Date: 2026-02-22 13:48+0000\n"
"PO-Revision-Date: 2025-12-11 17:10+0000\n"
"Last-Translator: return42 <return42@noreply.codeberg.org>\n"
"PO-Revision-Date: 2026-03-11 17:29+0000\n"
"Last-Translator: omeritzics <omeritzics@noreply.codeberg.org>\n"
"Language-Team: Hebrew <https://translate.codeberg.org/projects/searxng/"
"searxng/he/>\n"
"Language: he\n"
"Language-Team: Hebrew "
"<https://translate.codeberg.org/projects/searxng/searxng/he/>\n"
"Plural-Forms: nplurals=4; plural=(n == 1) ? 0 : ((n == 2) ? 1 : ((n > 10 "
"&& n % 10 == 0) ? 2 : 3));\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=utf-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=4; plural=(n == 1) ? 0 : ((n == 2) ? 1 : ((n > 10 && "
"n % 10 == 0) ? 2 : 3));\n"
"X-Generator: Weblate 5.15.2\n"
"Generated-By: Babel 2.18.0\n"
#. CONSTANT_NAMES['NO_SUBGROUPING']
@@ -188,7 +190,7 @@ msgstr "זמינות"
#. BRAND_CUSTOM_LINKS['ABOUT']
#: searx/searxng.msg searx/templates/simple/base.html:46
msgid "About"
msgstr "אודות"
msgstr "על אודות"
#. WEATHER_TERMS['AVERAGE TEMP.']
#: searx/searxng.msg
@@ -733,7 +735,7 @@ msgstr "מסנן תוצאות onion שמופיעות ברשימת השחורה
#: searx/plugins/calculator.py:25
msgid "Calculator"
msgstr ""
msgstr "מחשבון"
#: searx/plugins/calculator.py:26
msgid "Parses and solves mathematical expressions."
@@ -805,11 +807,11 @@ msgstr "סוכן המשתמש שלך הוא: "
#: searx/plugins/time_zone.py:33
msgid "Timezones plugin"
msgstr ""
msgstr "תוסף אזורי זמן"
#: searx/plugins/time_zone.py:34
msgid "Display the current time on different time zones."
msgstr ""
msgstr "הצגת השעה הנוכחית באזורי זמן שונים."
#: searx/plugins/tor_check.py:41
msgid "Tor check plugin"
@@ -1024,7 +1026,7 @@ msgstr "פרטיות"
#: searx/templates/simple/preferences.html:235
msgid "Engines"
msgstr "מנועים"
msgstr "מנועי חיפוש"
#: searx/templates/simple/preferences.html:237
msgid "Currently used search engines"
@@ -1065,17 +1067,17 @@ msgstr "הצג את העמוד הראשי"
#: searx/templates/simple/search.html:9
#: searx/templates/simple/simple_search.html:5
msgid "Search for..."
msgstr "הקלד מילות חיפוש..."
msgstr "חיפוש..."
#: searx/templates/simple/search.html:10
#: searx/templates/simple/simple_search.html:6
msgid "clear"
msgstr "נקה"
msgstr "ניקוי"
#: searx/templates/simple/search.html:11
#: searx/templates/simple/simple_search.html:7
msgid "search"
msgstr "חפש"
msgstr "חיפוש"
#: searx/templates/simple/stats.html:21
msgid "There is currently no data available. "
@@ -1084,7 +1086,7 @@ msgstr "אין כעת מידע זמין. "
#: searx/templates/simple/preferences/engines.html:24
#: searx/templates/simple/stats.html:25
msgid "Engine name"
msgstr "שם מנוע"
msgstr "שם מנוע חיפוש"
#: searx/templates/simple/stats.html:26
msgid "Scores"
@@ -1103,7 +1105,7 @@ msgstr "זמן תגובה"
#: searx/templates/simple/preferences/engines.html:35
#: searx/templates/simple/stats.html:29
msgid "Reliability"
msgstr "מהימנות"
msgstr "אמינות"
#: searx/templates/simple/stats.html:59
msgid "Total"
@@ -1434,11 +1436,11 @@ msgstr ""
#: searx/templates/simple/preferences/engines.html:15
msgid "Enable all"
msgstr "אפשר הכל"
msgstr "לאפשר הכול"
#: searx/templates/simple/preferences/engines.html:16
msgid "Disable all"
msgstr "בטל הכל"
msgstr "להשבית הכול"
#: searx/templates/simple/preferences/engines.html:25
msgid "!bang"
@@ -1473,6 +1475,8 @@ msgstr ""
#: searx/templates/simple/preferences/footer.html:3
msgid "These cookies serve your sole convenience; we don't use them to track you."
msgstr ""
"קובצי העוגיות האלה נועדו אך ורק בשביל הנוחות שלך אנחנו לא משתמשים בהם "
"למעקב אחריך."
#: searx/templates/simple/preferences/footer.html:6
msgid "Save"
@@ -1540,11 +1544,11 @@ msgstr ""
#: searx/templates/simple/preferences/results_on_new_tab.html:2
msgid "Results in new tabs"
msgstr ""
msgstr "תוצאות בלשוניות חדשות"
#: searx/templates/simple/preferences/results_on_new_tab.html:14
msgid "Open result links in new browser tabs"
msgstr ""
msgstr "פתיחת קישורי התוצאות בלשוניות דפדפן חדשות"
#: searx/templates/simple/preferences/safesearch.html:20
msgid "Filter content"
@@ -1566,7 +1570,7 @@ msgstr "מוטיב"
#: searx/templates/simple/preferences/theme.html:14
msgid "Change the layout of SearXNG"
msgstr ""
msgstr "שינוי הפריסה של SearXNG"
#: searx/templates/simple/preferences/theme.html:19
msgid "Theme style"
@@ -1649,7 +1653,7 @@ msgstr "סוג"
#: searx/templates/simple/result_templates/file.html:67
msgid "Download"
msgstr ""
msgstr "הורדה"
#: searx/templates/simple/result_templates/images.html:20
msgid "Resolution"
@@ -2361,4 +2365,3 @@ msgstr "הסתר וידאו"
#~ msgid "Comment(s)"
#~ msgstr "הערות"

View File

@@ -37,13 +37,14 @@
# return42 <return42@noreply.codeberg.org>, 2025, 2026.
# artens <artens@noreply.codeberg.org>, 2025.
# SecularSteve <secularsteve@noreply.codeberg.org>, 2025.
# Stephan-P <stephan-p@noreply.codeberg.org>, 2026.
msgid ""
msgstr ""
"Project-Id-Version: searx\n"
"Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
"POT-Creation-Date: 2026-02-22 13:48+0000\n"
"PO-Revision-Date: 2026-03-02 08:29+0000\n"
"Last-Translator: return42 <return42@noreply.codeberg.org>\n"
"PO-Revision-Date: 2026-03-09 08:29+0000\n"
"Last-Translator: Stephan-P <stephan-p@noreply.codeberg.org>\n"
"Language-Team: Dutch <https://translate.codeberg.org/projects/searxng/"
"searxng/nl/>\n"
"Language: nl\n"
@@ -752,7 +753,7 @@ msgstr "Rekenmachine"
#: searx/plugins/calculator.py:26
msgid "Parses and solves mathematical expressions."
msgstr ""
msgstr "Verwerkt en lost wiskundige uitdrukkingen op."
#: searx/plugins/hash_plugin.py:33
msgid "Hash plugin"
@@ -789,6 +790,8 @@ msgid ""
"Automatically loads the next page when scrolling to bottom of the current"
" page"
msgstr ""
"Laadt automatisch de volgende pagina wanneer je naar de onderkant van de "
"huidige pagina scrolt"
#: searx/plugins/oa_doi_rewrite.py:54
msgid "Open Access DOI rewrite"