Fix XSS vulnerability in searchresults

[GerDner]

a user may use htmlchars in the searchterm which are not escaped in the sprintffunction.

[jkphl]

@GerDner Sounds reasonable, thanks for the heads-up!

However, just off the top of my head: The way you fix the vulnerability would als lead to the text "Search for: ..." being htmlspecialchared, right? That might work with English (and German), but could lead to unexpected behaviour in other languages ... Wouldn't it be better to use something like this:

<h2 class="tx-twlucenesearch-headline"><f:translate key="search.searchfor" arguments="{0: searchterm -> f:format.htmlspecialchars(...)}"/></h2>

(Untested; not sure if you can use the inline syntax for the viewhelper like this. Maybe it rather has to be something like this: arguments="{0: '{f:format.htmlspecialchars(...)}'}")

[GerDner]

I can test this later and give feedback - thx for quick response

[jkphl]

:+1:

[GerDner]

<f:translate key="search.searchfor" arguments="{0: '{f:format.htmlspecialchars(value: searchterm)}'}"/>

works fine

[jkphl]

@GerDner Excellent. Merged. And thanks again! :)