double-sanityze query box

ServiceCanada · Jul 11, 2024 · de857db · de857db
1 parent 4a5bafe
commit de857db
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/connector.js b/src/connector.js
@@ -611,10 +611,10 @@ function initEngine() {
 	}
 
 	if ( hashParams.q && searchBoxElement ) {
-		searchBoxElement.value = hashParams.q;
+		searchBoxElement.value = DOMPurify.sanitize( hashParams.q );
 	}
 	else if ( urlParams.q && searchBoxElement ) {
-		searchBoxElement.value = urlParams.q;
+		searchBoxElement.value = DOMPurify.sanitize( urlParams.q );
 	}
 
 	// Get the query portion of the URL