From 4805a64c4cd536f72175b7c43f96c8c599a73e70 Mon Sep 17 00:00:00 2001
From: apoorva-01 <vermaapoorva0510@gmail.com>
Date: Wed, 8 Jul 2026 06:08:07 +0530
Subject: [PATCH] Don't mark striptags output as safe in search results

striptags output isn't HTML-safe, so |safe on it is exactly what Django's
docs warn against. Dropping |safe alone would double-escape (strip_tags
leaves entities encoded), so unescape the description at index time and
let autoescaping do the work.
---
 apps/downloads/search_indexes.py              |  3 +-
 apps/downloads/tests/test_search_indexes.py   | 22 +++++++++++++
 apps/events/search_indexes.py                 |  6 ++--
 apps/events/tests/test_search_indexes.py      | 31 +++++++++++++++++++
 apps/jobs/search_indexes.py                   |  4 ++-
 apps/jobs/tests/test_search_indexes.py        | 24 ++++++++++++++
 apps/pages/search_indexes.py                  |  4 ++-
 apps/pages/tests/test_search_indexes.py       | 20 ++++++++++++
 .../search/includes/downloads.release.html    |  2 +-
 .../search/includes/events.calendar.html      |  2 +-
 templates/search/includes/events.event.html   |  2 +-
 templates/search/includes/jobs.job.html       |  2 +-
 12 files changed, 113 insertions(+), 9 deletions(-)
 create mode 100644 apps/downloads/tests/test_search_indexes.py
 create mode 100644 apps/events/tests/test_search_indexes.py
 create mode 100644 apps/jobs/tests/test_search_indexes.py
 create mode 100644 apps/pages/tests/test_search_indexes.py

diff --git a/apps/downloads/search_indexes.py b/apps/downloads/search_indexes.py
index c56dc1e06..2bc71acdb 100644
--- a/apps/downloads/search_indexes.py
+++ b/apps/downloads/search_indexes.py
@@ -1,6 +1,7 @@
 """Haystack search indexes for the downloads app."""
 
 import datetime
+import html
 
 from django.template.defaultfilters import striptags, truncatewords_html
 from django.utils import timezone
@@ -43,7 +44,7 @@ def prepare_version(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text description."""
-        return striptags(truncatewords_html(obj.content.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.content.rendered, 50)))
 
     def prepare(self, obj):
         """Boost recent releases."""
diff --git a/apps/downloads/tests/test_search_indexes.py b/apps/downloads/tests/test_search_indexes.py
new file mode 100644
index 000000000..15bfa27d6
--- /dev/null
+++ b/apps/downloads/tests/test_search_indexes.py
@@ -0,0 +1,22 @@
+from types import SimpleNamespace
+
+from django.template.loader import render_to_string
+from django.test import SimpleTestCase
+
+from apps.downloads.search_indexes import ReleaseIndex
+
+
+class ReleaseSearchIndexTests(SimpleTestCase):
+    def test_prepare_description_returns_plain_text(self):
+        obj = SimpleNamespace(content=SimpleNamespace(rendered="<p>Data &amp; AI role <script>alert(1)</script></p>"))
+
+        self.assertEqual(ReleaseIndex().prepare_description(obj), "Data & AI role alert(1)")
+
+    def test_result_template_escapes_description(self):
+        rendered = render_to_string(
+            "search/includes/downloads.release.html",
+            {"result": {"description": "<script>alert(1)</script>"}},
+        )
+
+        self.assertNotIn("<script>", rendered)
+        self.assertIn("&lt;script&gt;", rendered)
diff --git a/apps/events/search_indexes.py b/apps/events/search_indexes.py
index 827a2309f..3d3413e31 100644
--- a/apps/events/search_indexes.py
+++ b/apps/events/search_indexes.py
@@ -1,5 +1,7 @@
 """Haystack search indexes for the events app."""
 
+import html
+
 from django.template.defaultfilters import striptags, truncatewords_html
 from haystack import indexes
 
@@ -28,7 +30,7 @@ def prepare_path(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text description."""
-        return striptags(truncatewords_html(obj.description, 50))
+        return html.unescape(striptags(truncatewords_html(obj.description, 50)))
 
     def prepare_include_template(self, obj):
         """Return the search result template path."""
@@ -65,7 +67,7 @@ def prepare_path(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text description."""
-        return striptags(truncatewords_html(obj.description.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.description.rendered, 50)))
 
     def prepare_venue(self, obj):
         """Return the venue name or None if no venue is set."""
diff --git a/apps/events/tests/test_search_indexes.py b/apps/events/tests/test_search_indexes.py
new file mode 100644
index 000000000..6f6fb0a42
--- /dev/null
+++ b/apps/events/tests/test_search_indexes.py
@@ -0,0 +1,31 @@
+from types import SimpleNamespace
+
+from django.template.loader import render_to_string
+from django.test import SimpleTestCase
+
+from apps.events.search_indexes import CalendarIndex, EventIndex
+
+
+class EventSearchIndexTests(SimpleTestCase):
+    def test_event_prepare_description_returns_plain_text(self):
+        obj = SimpleNamespace(
+            description=SimpleNamespace(rendered="<p>Data &amp; AI role <script>alert(1)</script></p>")
+        )
+
+        self.assertEqual(EventIndex().prepare_description(obj), "Data & AI role alert(1)")
+
+    def test_calendar_prepare_description_returns_plain_text(self):
+        obj = SimpleNamespace(description="<p>Data &amp; AI role <script>alert(1)</script></p>")
+
+        self.assertEqual(CalendarIndex().prepare_description(obj), "Data & AI role alert(1)")
+
+    def test_result_templates_escape_description(self):
+        for template in (
+            "search/includes/events.event.html",
+            "search/includes/events.calendar.html",
+        ):
+            with self.subTest(template=template):
+                rendered = render_to_string(template, {"result": {"description": "<script>alert(1)</script>"}})
+
+                self.assertNotIn("<script>", rendered)
+                self.assertIn("&lt;script&gt;", rendered)
diff --git a/apps/jobs/search_indexes.py b/apps/jobs/search_indexes.py
index 48a712849..f2285200c 100644
--- a/apps/jobs/search_indexes.py
+++ b/apps/jobs/search_indexes.py
@@ -1,5 +1,7 @@
 """Haystack search indexes for the jobs app."""
 
+import html
+
 from django.template.defaultfilters import striptags, truncatewords_html
 from django.urls import reverse
 from haystack import indexes
@@ -101,7 +103,7 @@ def prepare_include_template(self, obj):
 
     def prepare_description(self, obj):
         """Return a truncated plain-text job description."""
-        return striptags(truncatewords_html(obj.description.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.description.rendered, 50)))
 
     def prepare_path(self, obj):
         """Return the URL for this job listing."""
diff --git a/apps/jobs/tests/test_search_indexes.py b/apps/jobs/tests/test_search_indexes.py
new file mode 100644
index 000000000..136258335
--- /dev/null
+++ b/apps/jobs/tests/test_search_indexes.py
@@ -0,0 +1,24 @@
+from types import SimpleNamespace
+
+from django.template.loader import render_to_string
+from django.test import SimpleTestCase
+
+from apps.jobs.search_indexes import JobIndex
+
+
+class JobSearchIndexTests(SimpleTestCase):
+    def test_prepare_description_returns_plain_text(self):
+        obj = SimpleNamespace(
+            description=SimpleNamespace(rendered="<p>Data &amp; AI role <script>alert(1)</script></p>")
+        )
+
+        self.assertEqual(JobIndex().prepare_description(obj), "Data & AI role alert(1)")
+
+    def test_result_template_escapes_description(self):
+        rendered = render_to_string(
+            "search/includes/jobs.job.html",
+            {"result": {"description": "<script>alert(1)</script>"}},
+        )
+
+        self.assertNotIn("<script>", rendered)
+        self.assertIn("&lt;script&gt;", rendered)
diff --git a/apps/pages/search_indexes.py b/apps/pages/search_indexes.py
index f94497773..e419f1d97 100644
--- a/apps/pages/search_indexes.py
+++ b/apps/pages/search_indexes.py
@@ -1,5 +1,7 @@
 """Haystack search indexes for the pages app."""
 
+import html
+
 from django.template.defaultfilters import striptags, truncatewords_html
 from haystack import indexes
 
@@ -27,7 +29,7 @@ def prepare_description(self, obj):
         """Create a description if none exists."""
         if obj.description:
             return obj.description
-        return striptags(truncatewords_html(obj.content.rendered, 50))
+        return html.unescape(striptags(truncatewords_html(obj.content.rendered, 50)))
 
     def index_queryset(self, using=None):
         """Only index published pages."""
diff --git a/apps/pages/tests/test_search_indexes.py b/apps/pages/tests/test_search_indexes.py
new file mode 100644
index 000000000..e5f8a76a0
--- /dev/null
+++ b/apps/pages/tests/test_search_indexes.py
@@ -0,0 +1,20 @@
+from types import SimpleNamespace
+
+from django.test import SimpleTestCase
+
+from apps.pages.search_indexes import PageIndex
+
+
+class PageSearchIndexTests(SimpleTestCase):
+    def test_prepare_description_falls_back_to_plain_text_content(self):
+        obj = SimpleNamespace(
+            description="",
+            content=SimpleNamespace(rendered="<p>Data &amp; AI role <script>alert(1)</script></p>"),
+        )
+
+        self.assertEqual(PageIndex().prepare_description(obj), "Data & AI role alert(1)")
+
+    def test_prepare_description_keeps_existing_description(self):
+        obj = SimpleNamespace(description="Kept &amp; raw", content=None)
+
+        self.assertEqual(PageIndex().prepare_description(obj), "Kept &amp; raw")
diff --git a/templates/search/includes/downloads.release.html b/templates/search/includes/downloads.release.html
index f2f808d7d..b55efedac 100644
--- a/templates/search/includes/downloads.release.html
+++ b/templates/search/includes/downloads.release.html
@@ -1,7 +1,7 @@
 <h3>Release &ndash; <a href="{{ result.path }}">{{ result.name }}</a></h3>
 <p>Version: {{ result.version }}</p>
 <p>Released: {{ result.release_date|date }}</p>
-<p>{{ result.description|safe }}</p>
+<p>{{ result.description }}</p>
 {% if result.release_notes_url %}
 <p><a href="{{ result.release_notes_url }}">View Release Notes</a></p>
 {% endif %}
diff --git a/templates/search/includes/events.calendar.html b/templates/search/includes/events.calendar.html
index 9fb6ff730..473c7cb21 100644
--- a/templates/search/includes/events.calendar.html
+++ b/templates/search/includes/events.calendar.html
@@ -1,5 +1,5 @@
 <h3>Calendar &ndash; <a href="/{{ result.path }}">{{ result.name }}</a></h3>
-<p>{{ result.description|safe }}</p>
+<p>{{ result.description }}</p>
 {% if result.rss %}
 <p><a href="{{ result.rss }}">RSS Feed</a></p>
 {% endif %}
diff --git a/templates/search/includes/events.event.html b/templates/search/includes/events.event.html
index f015b5513..43e859e32 100644
--- a/templates/search/includes/events.event.html
+++ b/templates/search/includes/events.event.html
@@ -25,4 +25,4 @@ <h3>Event &ndash; <a href="{{ result.path }}">{{ result.name }}</a></h3>
 <p>Location: {{ result.venue }}</p>
 {% endif %}
 
-<p>{{ result.description|safe }}</p>
\ No newline at end of file
+<p>{{ result.description }}</p>
\ No newline at end of file
diff --git a/templates/search/includes/jobs.job.html b/templates/search/includes/jobs.job.html
index 7dd2c0d68..b65c2ee40 100644
--- a/templates/search/includes/jobs.job.html
+++ b/templates/search/includes/jobs.job.html
@@ -3,4 +3,4 @@ <h3><a href="{{ result.path }}">Job - {{ result.name }}</a></h3>
 <p>Location: {{ result.city }}{% if result.region %}, {{ result.region }}{% endif %} {{ result.country }}</p>
 
 {% if result.telecommuting %}<p>Telecommuting: Yes</p>{% endif %}
-<p>{{ result.description|safe }}</p>
\ No newline at end of file
+<p>{{ result.description }}</p>
\ No newline at end of file