Suggestion is rendered without html escaping

[Jun Omae]

We should use function to escape to template option rather than default template function.

$ git grep '\<template\>' -- src
src/dropdown.js:        html +=   datum.strategy.template(datum.value, datum.term);
src/strategy.js:    template:   function (obj) { return obj; },

wikiautocomplete/htdocs/js/wikiautocomplete.js

@@ -3 +3 @@
         return value.replace(/\$/g, '$$$$');
     }
 
+    function template(text, term) {
+        return $.htmlEscape(text);
+    }
+
     $('textarea.wikitext').textcomplete([
         { // Attachment
             match: /\b((?:raw-)?attachment):(\S*)$/,
@@ -14 +18 @@
                     .fail(function () { callback([]); });
             },
             index: 2,
+            template: template,
             replace: function (name) {
                 if (/\s/.test(name))
                     name = '"' + name + '"';
@@ -30 +35 @@
                     .fail(function () { callback([]); });
             },
             index: 2,
+            template: template,
             replace: function (resolver) {
                 return ['$1[' + escape_newvalue(resolver) + ':', ']'];
             },
@@ -45 +51 @@
             },
             index: 1,
             template: function (ticket) {
-                return '#' + ticket.id + ' ' + ticket.summary;
+                return $.htmlEscape('#' + ticket.id + ' ' + ticket.summary);
             },
             replace: function (ticket) {
                 return '#' + ticket.id;
@@ -61 +67 @@
                     .fail(function () { callback([]); });
             },
             index: 1,
+            template: template,
             replace: function (wikipage) {
                 return 'wiki:' + escape_newvalue(wikipage);
             },
@@ -92 +99 @@
                     .fail(function () { callback([]); });
             },
             index: 2,
+            template: template,
             replace: function (path) {
                 return '$1' + escape_newvalue(path);
             },

[Peter Suter]

Sounds good, thanks.

[Jun Omae]

In 15951:

WikiAutoCompletePlugin: escape html meta characters in suggestion (closes #12940)