Merge pull request #6 from concrete5/fix-xss

Fixing XSS in search

Author: aembler

controllers/single_page/search.php

@@ -15,7 +15,7 @@ public function view()
 
         $input = $query->get('keywords');
         $filter = $query->get('filter');
-        $tags = $query->get('tags');
+        $tags = $this->extractTags($query->get('tags'));
         $itemsPerPage = $query->get('ipp');
         $filterLabel = 'Anything';
 
@@ -63,7 +63,7 @@ public function view()
             }
         } else {
             if ($tags) {
-                foreach ((array)$tags as $tag) {
+                foreach ($tags as $tag) {
                     $list->filterByAssetTags($tag);
                 }
                 $keywords = $tags;
@@ -122,6 +122,24 @@ public function view()
         $this->set('showCollectionResults', $showCollectionResults);
     }
 
+    /**
+     * @param mixed $tags
+     * @return array
+     */
+    protected function extractTags($tags) : array
+    {
+        $return = [];
+        if (is_array($tags)) {
+            foreach ($tags as $tag) {
+                $tag = preg_replace('/[<>"\']/', '', $tag);
+                if ($tag) {
+                    $return[] = $tag;
+                }
+            }
+        }
+        return $return;
+    }
+
     public function getRemoveTagUrl($keyword)
     {
         $url = \URL::to('/search');

single_pages/search.php

@@ -65,7 +65,7 @@
                             <?php foreach ($keywords as $keyword) {
                                 $tagUrl = $view->controller->getRemoveTagUrl($keyword);
                                 ?>
-                                <span><?= $keyword ?> <a href="<?=$tagUrl?>"><i class="fa fa-close"></i></a></span>
+                                <span><?= h($keyword) ?> <a href="<?=$tagUrl?>"><i class="fa fa-close"></i></a></span>
                             <?php } ?>
                         </div>
                     <?php } ?>