fix: prevent raw HTML appearing in default element behavior

GetmeUK · May 12, 2022 · e86eac5 · e86eac5
1 parent 3b7a766
commit e86eac5
Show file tree

Hide file tree

Showing 3 changed files with 191 additions and 187 deletions.
diff --git a/module/typeahead.js b/module/typeahead.js
@@ -148,7 +148,9 @@ export class Typeahead {
                 switch (event.key) {
 
                 case 'Tab':
-                    if (this._options.mustMatch) {
+                    const q = this.constructor.behaviours
+                        .query[this._behaviours.query](this)
+                    if (this._options.mustMatch && q) {
                         this.select()
                     }
                     break
@@ -726,7 +728,11 @@ Typeahead.behaviours = {
 
             // Add the suggestion to the element and mark the portion of the
             // suggestion that matches the query.
-            elm.innerHTML = suggestion.label.replace(
+
+            const escapeDiv = document.createElement('div')
+            escapeDiv.textContent = suggestion.label
+
+            elm.innerHTML = escapeDiv.innerHTML.replace(
                 new RegExp($.escapeRegExp(q), 'gi'),
                 '<mark>$&</mark>'
             )