Fix escaping special html entites in search output

CHANGELOG.md

@@ -22,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* Fix escaping special html entities in search output. ([#2441], [#2461])
 * Fix the search filter toggle button styling in the HTML output. ([#2406], [#2408])
 * The theme selector for the HTML output now correctly picks `Automatic (OS)` if the user hasn't explicitly set the theme. ([#2414], [#2438])
 * Fix the search window sometimes not appearing in the HTML output. ([#2430], [#2458])
@@ -1800,9 +1801,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#2415]: https://github.com/JuliaDocs/Documenter.jl/issues/2415
 [#2430]: https://github.com/JuliaDocs/Documenter.jl/issues/2430
 [#2438]: https://github.com/JuliaDocs/Documenter.jl/issues/2438
+[#2441]: https://github.com/JuliaDocs/Documenter.jl/issues/2441
 [#2458]: https://github.com/JuliaDocs/Documenter.jl/issues/2458
 [#2459]: https://github.com/JuliaDocs/Documenter.jl/issues/2459
 [#2460]: https://github.com/JuliaDocs/Documenter.jl/issues/2460
+[#2461]: https://github.com/JuliaDocs/Documenter.jl/issues/2461
 [JuliaLang/julia#36953]: https://github.com/JuliaLang/julia/issues/36953
 [JuliaLang/julia#38054]: https://github.com/JuliaLang/julia/issues/38054
 [JuliaLang/julia#39841]: https://github.com/JuliaLang/julia/issues/39841

assets/html/js/search.js

@@ -215,6 +215,35 @@ function worker_function(documenterSearchIndex, documenterBaseURL, filters) {
 
   index.addAll(data);
 
+  /**
+   *  Used to map characters to HTML entities.
+   * Refer: https://github.com/lodash/lodash/blob/main/src/escape.ts
+   */
+  const htmlEscapes = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;",
+  };
+
+  /**
+   * Used to match HTML entities and HTML characters.
+   * Refer: https://github.com/lodash/lodash/blob/main/src/escape.ts
+   */
+  const reUnescapedHtml = /[&<>"']/g;
+  const reHasUnescapedHtml = RegExp(reUnescapedHtml.source);
+
+  /**
+   * Escape function from lodash
+   * Refer: https://github.com/lodash/lodash/blob/main/src/escape.ts
+   */
+  function escape(string) {
+    return string && reHasUnescapedHtml.test(string)
+      ? string.replace(reUnescapedHtml, (chr) => htmlEscapes[chr])
+      : string || "";
+  }
+
   /**
    * Make the result component given a minisearch result data object and the value
    * of the search input as queryString. To view the result object structure, refer:
@@ -246,10 +275,12 @@ function worker_function(documenterSearchIndex, documenterBaseURL, filters) {
           )
         : ""; // cut-off text before and after from the match
 
+    text = text.length ? escape(text) : "";
+
     let display_result = text.length
       ? "..." +
         text.replace(
-          new RegExp(`${querystring}`, "i"), // For first occurrence
+          new RegExp(`${escape(querystring)}`, "i"), // For first occurrence
           '<span class="search-result-highlight py-1">$&</span>'
         ) +
         "..."
@@ -268,7 +299,7 @@ function worker_function(documenterSearchIndex, documenterBaseURL, filters) {
           <div class="w-100 is-flex is-flex-wrap-wrap is-justify-content-space-between is-align-items-flex-start">
             <div class="search-result-title has-text-weight-bold ${
               in_code ? "search-result-code-title" : ""
-            }">${result.title}</div>
+            }">${escape(result.title)}</div>
             <div class="property-search-result-badge">${result.category}</div>
           </div>
           <p>