Browse Source

[fix] simple theme: make autocomplete-js CSP compliant

The CSP issue is, that the `_Position` function in the autocomplete-js set the
style attributes by `setAttribute("style", ...)`.  Using `setAttribute` to set
the style attribute invokes the HTML parser and CSP is triggered [1].

This patch overwrite the `_Position` function of autocomplete-js.

BTW: remove trailing whitespace

[1] https://stackoverflow.com/a/57633533

Closes: https://github.com/searxng/searxng/issues/352
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
Markus Heiser 3 years ago
parent
commit
2b26285a73
1 changed files with 7 additions and 1 deletions
  1. 7 1
      searx/static/themes/simple/src/js/main/search.js

+ 7 - 1
searx/static/themes/simple/src/js/main/search.js

@@ -54,7 +54,7 @@
     if (qinput !== null) {
     if (qinput !== null) {
       // clear button
       // clear button
       createClearButton(qinput);
       createClearButton(qinput);
-      
+
       // autocompleter
       // autocompleter
       if (searxng.autocompleter) {
       if (searxng.autocompleter) {
         searxng.autocomplete = AutoComplete.call(w, {
         searxng.autocomplete = AutoComplete.call(w, {
@@ -67,6 +67,12 @@
           },
           },
           MinChars: 4,
           MinChars: 4,
           Delay: 300,
           Delay: 300,
+          _Position:function() {
+            this.DOMResults.setAttribute("class", "autocomplete");
+            this.DOMResults.style.top = (this.Input.offsetTop + this.Input.offsetHeight) + "px";
+            this.DOMResults.style.left = this.Input.offsetLeft + "px";
+            this.DOMResults.style.width = this.Input.clientWidth + "px";
+          },
         }, "#" + qinput_id);
         }, "#" + qinput_id);
 
 
         // hack, see : https://github.com/autocompletejs/autocomplete.js/issues/37
         // hack, see : https://github.com/autocompletejs/autocomplete.js/issues/37