Search doesn't escape things that it should

pie_flavor

Search for example std::ostream&. The & gets clipped off the end, and a look at the URL shows that the & is unescaped and so treated as a part of the URL. However, run a search for std::ostream%26, and it'll turn into a search for std::ostream& allowing you to find the correct result.

pie_flavor

It also seems like spaces are encoded as %20 instead of +.

anonymous234

You're right, it doesn't seem to escape '&'s at all. This is pretty big deal for a web developer to forget.

It does escape '<'s, so no luck with the XSS today.

ben_lubar

Search queries are not URL-encoded · Issue #6771 · NodeBB/NodeBB

NodeBB version: 1.10.1 NodeBB git hash: 12940b5 Database type: postgres Database version: postgres (PostgreSQL) 10.5 (Debian 10.5-1.pgdg90+1) Exact steps to cause this issue: Search for something c...

ben_lubar

@anonymous234 said in Search doesn't escape things that it should:

You're right, it doesn't seem to escape '&'s at all. This is pretty big deal for a web developer to forget.

It does escape '<'s, so no luck with the XSS today.

Pretty sure it's not explicitly escaping <. That's probably just your browser doing it, like with spaces.