Autocomplete: Escape HTML tags in callback name to avoid XSS in demo

Fixes #15048

diff --git a/demos/autocomplete/search.php b/demos/autocomplete/search.php
index 489b30c1e314eaaf520262faf2eb2f9a104da18e..6ab404ccbd034dafa433342ddc561c0193af4e7f 100644 (file)
--- a/demos/autocomplete/search.php
+++ b/demos/autocomplete/search.php
@@ -586,7 +586,10 @@ foreach ($items as $key=>$value) {
 $output = json_encode($result);
 
 if ($_GET["callback"]) {
-       $output = $_GET["callback"] . "($output);";
+       // Escape special characters to avoid XSS attacks via direct loads of this
+       // page with a callback that contains HTML. This is a lot easier than validating
+       // the callback name.
+       $output = htmlspecialchars($_GET["callback"]) . "($output);";
 }
 
 echo $output;