Fixed RXSS vulnerability in search results

Author: squidfunk

material/templates/assets/javascripts/bundle.20f8b5b3.min.js

@@ -249,7 +249,7 @@
       </script>
     {% endblock %}
     {% block scripts %}
-      <script src="{{ 'assets/javascripts/bundle.20f8b5b3.min.js' | url }}"></script>
+      <script src="{{ 'assets/javascripts/bundle.471ce7a9.min.js' | url }}"></script>
       {% for script in config.extra_javascript %}
         {{ script | script_tag }}
       {% endfor %}

material/templates/assets/javascripts/bundle.471ce7a9.min.js

@@ -20,6 +20,7 @@
  * IN THE SOFTWARE.
  */
 
+import escapeHTML from "escape-html"
 import { ComponentChild } from "preact"
 
 import { configuration, feature, translation } from "~/_"
@@ -60,7 +61,7 @@ function renderSearchDocument(
   const missing = Object.keys(document.terms)
     .filter(key => !document.terms[key])
     .reduce<ComponentChild[]>((list, key) => [
-      ...list, <del>{key}</del>, " "
+      ...list, <del>{escapeHTML(key)}</del>, " "
     ], [])
     .slice(0, -1)