Merge pull request #3999 from 10up/fix/issue-3968

Escape special chars on Instant Results and Autosuggest
10up · Nov 7, 2024 · c702b78 · c702b78
2 parents d57b135 + 7678a95
commit c702b78
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/assets/js/instant-results/components/results/result.js b/assets/js/instant-results/components/results/result.js
@@ -8,6 +8,7 @@ import { WPElement } from '@wordpress/element';
  */
 import { postTypeLabels } from '../../config';
 import { formatDate } from '../../utilities';
+import { escapeRegExp } from '../../../utils/helpers';
 import Result from '../common/result';
 
 /**
@@ -36,7 +37,7 @@ export default ({ hit, searchTerm, highlightTag }) => {
 	/**
 	 * Note: highlighting is redone here because the unified highlight type is not supported in ES5
 	 */
-	const regex = new RegExp(`\\b(${searchTerm})`, 'gi');
+	const regex = new RegExp(`\\b(${escapeRegExp(searchTerm)})`, 'gi');
 	let title;
 
 	if (highlightTag === '' || highlightTag === undefined) {

diff --git a/assets/js/utils/helpers.js b/assets/js/utils/helpers.js
@@ -47,7 +47,10 @@ export const escapeRegExp = (string) => string.replace(/[.*+?^${}()|[\]\\]/g, '\
  * @returns {string} replaced string
  */
 export const replaceGlobally = (string, term, replacement) => {
-	return string.replace(new RegExp(escapeRegExp(term), 'g'), replacement);
+	return string.replace(
+		new RegExp(escapeRegExp(term), 'g'),
+		JSON.stringify(replacement).slice(1, -1), // Escapes especial chars and remove quotes added by JSON.stringify
+	);
 };
 
 /**