util: Properly handle markup in highlighter

The code to highlight matches did not properly escape the passed in text
as for markup before adding its highlighting markup. This lead to some
search result descriptions not showing up, because their descriptions
contained characters, such as "<", that would have to be escaped when
used in markup or otherwise lead to invalid markup.

To work around this some search providers wrongly started escaping the
description on their end before sending them to gnome-shell. This lead
to another issue. Now if the highlighter was trying to highlight the
term "a", and the escaped description contained "&apos;", the "a" in
that would be considered a match and surrounded by "<b></b>". This
however would also generate invalid markup, again leading to an error
and the description not being shown.

Fix this by always escaping the passed in string before applying the
highlights in such a way that there are no matches within entities.

This also means that search providers that escaped their description
strings will now show up with the markup syntax. This will have to be
fixed separately in the affected search providers.

Fixes: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/4791
Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2033>

diff --git a/js/misc/util.js b/js/misc/util.js
index 183b84b7a2fa15c0eeac55c74140fe865f63c8a3..6a0f6f641402fb3397bdeec006e6e6477f7f3572 100644 (file)
--- a/js/misc/util.js
+++ b/js/misc/util.js
@@ -585,8 +585,25 @@ var Highlighter = class {
      */
     highlight(text) {
         if (!this._highlightRegex)
-            return text;
+            return GLib.markup_escape_text(text, -1);
+
+        let escaped = [];
+        let lastMatchEnd = 0;
+        let match;
+        while ((match = this._highlightRegex.exec(text))) {
+            if (match.index > lastMatchEnd) {
+                let unmatched = GLib.markup_escape_text(
+                    text.slice(lastMatchEnd, match.index), -1);
+                escaped.push(unmatched);
+            }
+            let matched = GLib.markup_escape_text(match[0], -1);
+            escaped.push('<b>%s</b>'.format(matched));
+            lastMatchEnd = match.index + match[0].length;
+        }
+        let unmatched = GLib.markup_escape_text(
+            text.slice(lastMatchEnd), -1);
+        escaped.push(unmatched);
 
-        return text.replace(this._highlightRegex, '<b>$1</b>');
+        return escaped.join('');
     }
 };