Fix search result descriptions are double-escaped

[sy-records]

Fix #1239

The data is already escaped.

[github-actions]

🚀 Preview for commit 26adabc can be found at https://web-php-pr-1252.preview.thephp.foundation

[github-actions]

🚀 Regression report for commit 26adabc is at https://web-php-regression-report-pr-1252.preview.thephp.foundation

[stof]

Returned escaped HTML in the JSON is quite uncommon though. It is generally recommended to perform the escaping at the point of displaying. Maybe the JSON should be changed instead.

[lhsazevedo]

It is generally recommended to perform the escaping at the point of displaying

Agreed. A simple solution would be to decode the HTML entities before escaping. This prevents double escaping while still protecting against XSS:

const decodeHtmlEntities = (str) => {
  const textarea = document.createElement('textarea');
  textarea.innerHTML = str;
  return textarea.value;
};

- ${escape(description)}
+ ${escape(decodeHtmlEntities(description))}

Authenticate as &quot;none&quot; <img src=x onerror="alert(\'XSS Attack\')"> &lt;img src=x onerror=&quot;alert(\&#39;XSS Attack\&#39;)&quot;&gt;

See this demo and this answer.

[stof]

Agreed. A simple solution would be to decode the HTML entities before escaping.

To me, a better solution is to remove the escaping performed when generating the Json response.

[sy-records]

Returned escaped HTML in the JSON is quite uncommon though.

Since we are using the json format, if the string contains ", it will be escaped.

  <refname>ssh2_auth_none</refname>
  <refpurpose>Authenticate as "none"</refpurpose>

[stof]

@sy-records The JSON format does not require applying HTML escaping in its values.

[sy-records]

Yes, but no HTML will appear in the current scene.

[lhsazevedo]

I think @stof meant that HTML entities are not needed for escaping quotes just for JSON transport. We can use standard JSON escaping \":

{
  "example": "Authenticate as \"none\""
}

PHP json_encode and JavaScript JSON.parse should already handle this for us, and it should be transparent for our front-end code.

[stof]

Why do we need to decode it here ? Shouldn't the code generating search-description.json be updated instead ?

[sy-records]

php/phd#196