FIXED: kiwix-serve XSS attack vulnerability (#763)

src/common/kiwix/searcher.cpp

@@ -180,7 +180,7 @@ namespace kiwix {
     oData["pages"] = pagesCDT;
 
     oData["count"] = kiwix::beautifyInteger(this->estimatedResultCount);
-    oData["searchPattern"] = this->searchPattern;
+    oData["searchPattern"] = kiwix::encodeDiples(this->searchPattern);
     oData["searchPatternEncoded"] = urlEncode(this->searchPattern);
     oData["resultStart"] = this->resultStart + 1;
     oData["resultEnd"] = (this->resultEnd > this->estimatedResultCount ? this->estimatedResultCount : this->resultEnd);

src/common/stringTools.cpp

@@ -104,6 +104,14 @@ void kiwix::stringReplacement(std::string& str, const std::string& oldStr, const
   }
 }
 
+/* Encode string to avoid XSS attacks */
+std::string kiwix::encodeDiples(const std::string& str) {
+  std::string result = str;
+  kiwix::stringReplacement(result, "<", "&lt;");
+  kiwix::stringReplacement(result, ">", "&gt;");
+  return result;
+}
+
 // Urlencode
 //based on javascript encodeURIComponent()
 

src/common/stringTools.h

@@ -48,6 +48,7 @@ namespace kiwix {
   void printStringInHexadecimal(const char *s);
   void printStringInHexadecimal(UnicodeString s);
   void stringReplacement(std::string& str, const std::string& oldStr, const std::string& newStr);
+  std::string encodeDiples(const std::string& str);
 
 #endif