Merge pull request #36 from Neovici/gh35-1

35 - Sanitize RegExp input when highlighting suggestions
Neovici · Apr 18, 2019 · c73cddd · c73cddd
2 parents ad32975 + ee3514c
commit c73cddd
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/.eslintrc.json b/.eslintrc.json
@@ -87,7 +87,13 @@
 		"no-use-before-define": "error",
 		"no-useless-call": "error",
 		"no-useless-concat": "error",
-		"one-var": "error",
+		"one-var": [
+			"error",
+			{
+				"var": "always",
+				"let": "always"
+			}
+		],
 		"one-var-declaration-per-line": [
 			"error",
 			"always"

diff --git a/paper-autocomplete-chips.html b/paper-autocomplete-chips.html
@@ -255,7 +255,8 @@
 									continue;
 								}
 
-								result.html = result.text.replace(new RegExp('(' + query + ')', 'ig'), regexpResult);
+								const escapedQuery = query.replace(/[|\\{}()[\]^$+*?.-]/gu, '\\$&');
+								result.html = result.text.replace(new RegExp('(' + escapedQuery + ')', 'ig'), regexpResult);
 								results.push(result);
 
 								if (results.length >= maxResults) {