@alfresco/aca-content 7.2.0-17759257923 → 7.2.0-17828792793

package/fesm2022/alfresco-aca-content.mjs

@@ -10352,8 +10352,17 @@ class SearchResultsRowComponent {
     router;
     autoDownloadService;
     settings = inject(AppSettingsService);
-    highlightPrefix = "<span class='aca-highlight'>";
-    highlightPostfix = '</span>';
+    highlightPrefix = `<span class="aca-highlight">`;
+    highlightPostfix = `</span>`;
+    highlightOpenEscapedRegex = /&lt;span class=(['"])aca-highlight\1&gt;/g;
+    highlightCloseEscapedRegex = /&lt;\/span&gt;/g;
+    highlightOpenRawRegex = /<span class=(['"])aca-highlight\1>/g;
+    highlightCloseRawRegex = /<\/span>/g;
+    escapeMap = {
+        '&': '&amp;',
+        '<': '&lt;',
+        '>': '&gt;'
+    };
     node;
     context;
     name$ = new BehaviorSubject('');
@@ -10413,16 +10422,24 @@ class SearchResultsRowComponent {
                     break;
             }
         });
-        this.name$.next(name);
-        this.description$.next(description);
-        this.content$.next(content);
+        const safeName = this.sanitizeAndHighlight(name);
+        const safeDescription = this.sanitizeAndHighlight(description);
+        const safeContent = this.sanitizeAndHighlight(content);
+        this.name$.next(safeName);
+        this.description$.next(safeDescription);
+        this.content$.next(safeContent);
         this.nameStripped = this.stripHighlighting(name);
+        this.titleStripped = this.stripHighlighting(title);
         this.descriptionStripped = this.stripHighlighting(description);
         this.contentStripped = this.stripHighlighting(content);
-        if (title !== name) {
-            this.title$.next(title ? ` ( ${title} )` : '');
+        if (title && title !== name) {
+            const safeTitle = this.sanitizeAndHighlight(` ( ${title} )`);
+            this.title$.next(safeTitle);
             this.titleStripped = this.stripHighlighting(title);
         }
+        else {
+            this.title$.next('');
+        }
     }
     showPreview(event) {
         event.stopPropagation();
@@ -10434,10 +10451,19 @@ class SearchResultsRowComponent {
         event.stopPropagation();
         this.store.dispatch(new NavigateToFolder(this.node));
     }
-    stripHighlighting(highlightedContent) {
-        return highlightedContent
-            ? highlightedContent.replace(new RegExp(this.highlightPrefix, 'g'), '').replace(new RegExp(this.highlightPostfix, 'g'), '')
-            : '';
+    stripHighlighting(input) {
+        if (!input) {
+            return '';
+        }
+        return input.replace(this.highlightOpenRawRegex, '').replace(this.highlightCloseRawRegex, '');
+    }
+    sanitizeAndHighlight(value) {
+        if (!value) {
+            return '';
+        }
+        let escaped = value.replace(/[&<>]/g, (char) => this.escapeMap[char] ?? char);
+        escaped = escaped.replace(this.highlightOpenEscapedRegex, this.highlightPrefix).replace(this.highlightCloseEscapedRegex, this.highlightPostfix);
+        return escaped;
     }
     static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "19.2.6", ngImport: i0, type: SearchResultsRowComponent, deps: [{ token: i1.Store }, { token: i3.NodesApiService }, { token: i1$3.Router }, { token: i1$1.AutoDownloadService }], target: i0.ɵɵFactoryTarget.Component });
     static ɵcmp = i0.ɵɵngDeclareComponent({ minVersion: "14.0.0", version: "19.2.6", type: SearchResultsRowComponent, isStandalone: true, selector: "aca-search-results-row", inputs: { context: "context" }, host: { classAttribute: "aca-search-results-row" }, ngImport: i0, template: "<div class=\"aca-search-results-text\">\n  <div class=\"search-file-name\">\n    <span\n      tabindex=\"0\"\n      role=\"link\"\n      *ngIf=\"isFile\"\n      (click)=\"showPreview($event)\"\n      (keyup.enter)=\"showPreview($event)\"\n      class=\"aca-link aca-crop-text\"\n      [title]=\"nameStripped\"\n      [innerHTML]=\"name$ | async\"\n    ></span>\n    <span\n      tabindex=\"0\"\n      role=\"link\"\n      *ngIf=\"!isFile\"\n      (click)=\"navigate($event)\"\n      (keyup.enter)=\"navigate($event)\"\n      class=\"bold aca-link aca-crop-text\"\n      [title]=\"nameStripped\"\n      [innerHTML]=\"name$ | async\"\n    ></span>\n    <span\n      data-automation-id=\"search-results-entry-title\"\n      class=\"aca-crop-text\"\n      [title]=\"titleStripped\"\n      [innerHTML]=\"title$ | async\"\n    ></span>\n  </div>\n  <div\n    data-automation-id=\"search-results-entry-description\"\n    class=\"aca-crop-text\"\n    [title]=\"descriptionStripped\"\n    [innerHTML]=\"description$ | async\"\n  ></div>\n  <div class=\"aca-result-location\">\n    <aca-location-link [context]=\"context\" [showLocation]=\"true\" />\n  </div>\n  <div class=\"aca-result-content aca-crop-text\" [title]=\"contentStripped\" [innerHTML]=\"content$ | async\"></div>\n</div>\n<aca-datatable-cell-badges [node]=\"context.row.node\" />\n", styles: [".aca-search-results-row{display:flex;justify-content:space-between;align-items:center;padding:10px 0;width:inherit}.aca-search-results-row .aca-highlight{background:var(--theme-search-highlight-background-color)}.aca-search-results-row .aca-crop-text{overflow:hidden;text-overflow:ellipsis}.aca-search-results-row .aca-result-location{height:15px;padding-top:3px}.aca-search-results-row .aca-result-content{padding:0 5px;font-style:italic}.aca-search-results-row .aca-link{text-decoration:none;color:var(--theme-text-bold-color)}.aca-search-results-row .aca-location-link .adf-datatable-cell-value{padding:0;color:var(--theme-foreground-text-color)}.aca-search-results-row .aca-link:hover,.aca-search-results-row .aca-location-link .adf-datatable-cell-value:hover{color:var(--theme-primary-color);text-decoration:underline}.aca-search-results-row .adf-is-selected .aca-link:not(:hover),.aca-search-results-row .adf-is-selected .adf-datatable-cell-value:not(:hover){color:var(--theme-primary-color)}\n"], dependencies: [{ kind: "ngmodule", type: CommonModule }, { kind: "directive", type: i1$4.NgIf, selector: "[ngIf]", inputs: ["ngIf", "ngIfThen", "ngIfElse"] }, { kind: "pipe", type: i1$4.AsyncPipe, name: "async" }, { kind: "component", type: LocationLinkComponent, selector: "aca-location-link", inputs: ["context", "showLocation"] }, { kind: "ngmodule", type: MatDialogModule }, { kind: "component", type: DatatableCellBadgesComponent, selector: "aca-datatable-cell-badges", inputs: ["node"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush, encapsulation: i0.ViewEncapsulation.None });