[fix] route /autocompleter: escape '<' and '>' in the response

Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
3 years ago · 9a3253fc16
parent e27b1ac57a
commit 9a3253fc16
1 changed files with 1 additions and 0 deletions
--- a/searx/webapp.py
+++ b/searx/webapp.py
@ -916,6 +916,7 @@ def autocompleter():
        suggestions = json.dumps([sug_prefix, results])
        mimetype = 'application/x-suggestions+json'

+    suggestions = escape(suggestions, False)
    return Response(suggestions, mimetype=mimetype)