fix(search): remove |safe from search query to prevent XSS

Algorithm5838 · Algorithm5838 · commit 488e1211daa4 · 2026-04-26T23:43:14.000+03:00
diff --git a/src/search.rs b/src/search.rs
@@ -112,7 +112,7 @@ pub async fn find(req: Request<Body>) -> Result<Response<Body>, String> {
 			subreddits,
 			sub,
 			params: SearchParams {
-				q: query.replace('"', "&quot;"),
+				q: query,
 				sort,
 				t: param(&path, "t").unwrap_or_default(),
 				before: param(&path, "after").unwrap_or_default(),
@@ -138,7 +138,7 @@ pub async fn find(req: Request<Body>) -> Result<Response<Body>, String> {
 					subreddits,
 					sub,
 					params: SearchParams {
-						q: query.replace('"', "&quot;"),
+						q: query,
 						sort,
 						t: param(&path, "t").unwrap_or_default(),
 						before: param(&path, "after").unwrap_or_default(),
diff --git a/templates/search.html b/templates/search.html
@@ -11,7 +11,7 @@
 	<div id="column_one">
 		<form id="search_sort">
 			<div class="search_widget_divider_box">
-				<input id="search" type="text" name="q" placeholder="Search" value="{{ params.q|safe }}" title="Search redlib">
+				<input id="search" type="text" name="q" placeholder="Search" value="{{ params.q }}" title="Search redlib">
 				<div class="search_widget_divider_box">
 					{% if sub != "" %}
 					<div id="inside">
@@ -114,13 +114,13 @@
 		{% if params.typed != "sr_user" %}
 		<footer>
 			{% if params.before != "" %}
-			<a href="?q={{ params.q|safe }}&restrict_sr={{ params.restrict_sr }}
+			<a href="?q={{ params.q }}&restrict_sr={{ params.restrict_sr }}
 				&sort={{ params.sort }}&t={{ params.t }}
 				&before={{ params.before }}" accesskey="P">PREV</a>
 			{% endif %}
 
 			{% if params.after != "" %}
-			<a href="?q={{ params.q|safe }}&restrict_sr={{ params.restrict_sr }}
+			<a href="?q={{ params.q }}&restrict_sr={{ params.restrict_sr }}
 				&sort={{ params.sort }}&t={{ params.t }}
 				&after={{ params.after }}" accesskey="N">NEXT</a>
 			{% endif %}
