Ticket #5275 (closed bug: fixed)

Opened 4 years ago

Last modified 3 years ago

suggestions are not html-encoded

Reported by: wouter Owned by:
Priority: minor Milestone: 1.8.3
Component: ui.autocomplete Version: 1.8rc3
Keywords: Cc:
Blocking: Blocked by:

Description

If a suggestion in the auto-complete list contains characters such as < or &, these are not html-encoded, possibly messing up the html.

(When the suggestion is clicked the value that appears in the textbox is html-encoded.)

This is the solution I used:

	_renderItem: function( ul, item) {
		var a = $("<a></a>").text(item.label);
		return $( "<li></li>" )
			.data( "item.autocomplete", item )
			.append( a )
			.appendTo( ul );
	}

Change History

comment:1 Changed 4 years ago by scott.gonzalez

  • Status changed from new to closed
  • Resolution set to invalid

This is intended, to allow flexibility in the displays. If you want to prevent using HTML and only allow text, you can change the behavior. If you need help, please ask on the  forum.

comment:2 Changed 4 years ago by chungwu

  • Status changed from closed to reopened
  • Resolution invalid deleted

Using an HTML as a label is not a good way to customize display, as that HTML string is also the string that the widget will be regexp-filtering on (which is most likely not what the user wanted to do).

It would be nice to have _renderItem, by default, assume item.label is plaintext and Do The Safe Thing. More sophisticated users can override this behavior if they want to use fancy html (as the custom renderer demo does here:  http://jqueryui.com/demos/autocomplete/#custom-data)

comment:3 Changed 4 years ago by erikrose

Also, the HTML string is, by default, what will appear in the text field once chosen. I add my vote for HTML escaping by default.

comment:4 Changed 4 years ago by erikrose

Er, never mind; you already said that. *needs breakfast*

comment:5 Changed 4 years ago by scott.gonzalez

  • Status changed from reopened to closed
  • Resolution set to fixed
  • Milestone changed from TBD to 1.9

Defaulting to plaintext and defining your own render method for HTML and other complex displays makes sense. Fixed in  1f2cfb9.

comment:6 Changed 4 years ago by scott.gonzalez

  • Milestone changed from 1.9 to 1.8.3

comment:7 Changed 3 years ago by Scott González

Autocomplete: Render items as text, not HTML. Fixes #5275 - suggestions are not html-encoded.

As noted in the ticket, it's probably better to default to unstyled items to prevent problems. Users can still implement their own rendering method as shown in the custom data and display demo.

Changeset: 1f2cfb942f8ac5549b1fe3172501e3486415530e

Note: See TracTickets for help on using tickets.