mozilla / addons

☂ Umbrella repository for Mozilla Addons ✨
Other
125 stars 41 forks source link

Don't pass non-strings into Autosuggest #14323

Closed bobsilverberg closed 2 years ago

bobsilverberg commented 2 years ago

As described at https://github.com/moroshko/react-autosuggest/issues/368#issuecomment-302985738, Autosuggest expects that inputProps.value be a string, and will throw exceptions if it is not. One can create a non-string value for inputProps.value by using a querystring that makes q look like an object, for example ?q[0]=a&q[1]=b (or even just ?q[0]=a). Our code needs to make sure that this value never gets passed into Autosuggest.

The code for this is at https://github.com/mozilla/addons-frontend/blob/master/src/amo/components/AutoSearchInput/index.js#L337-L352, and the logic which creates inputProps is at https://github.com/mozilla/addons-frontend/blob/master/src/amo/components/AutoSearchInput/index.js#L298-L308. Note that value comes from this.state.searchValue, and this.state.searchValue is initially set to location.query[inputName]. It therefore seems like the optimal solution to this is to not set this.state.searchValue to location.query[inputName] if location.query[inputName] is not a string, and to just set this.state.searchValue to an empty string if that is the case.

location.query[inputName] will only be a non-string if someone purposely puts a bad querystring on the url.

ioanarusiczki commented 2 years ago

@bobsilverberg I verified the Console for:
https://addons.allizom.org/en-US/firefox/search/?q[0]=test
https://addons.allizom.org/en-US/firefox/search/?q[1]=facebook&q[0]=b or https://addons.allizom.org/en-US/firefox/search/?q[0]=facebook&q[1]=b Search results are displayed and the errors are not longer present in the Console.

Verified on -dev and -stage, FF93(Win10).