fix(ContentSearch): stop sanitizeSnippet rebuilding tags from its input

[IgorShevchik]

Linked issue

Closes #391.

Type of change

• Documentation (updates to the documentation or readme)
• Bug fix (a non-breaking change that fixes an issue)
• Enhancement (improving an existing functionality)
• New feature (a non-breaking change that adds functionality)
• Chore (updates to the build process or auxiliary tools and libraries)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

sanitizeSnippet preserved real <mark> tags by swapping them for \0markO\0 / \0markC\0, escaping everything, then swapping back. NUL is an ordinary character a snippet can carry, so what decided whether markup was emitted was a string the input could supply.

A whole sentinel forged a tag outright:

sanitizeSnippet('before \0markO\0 after')
// → 'before <mark> after'        one <mark> out, none in

sanitizeSnippet('\0markC\0\0markO\0')
// → '</mark><mark>'              a close ahead of its opener

The trigger is lower than that, and the consequence worse

Six of the seven bytes, immediately before a real tag, were enough. The placeholder the function inserted for that tag completed the prefix, and the restore step then found a sentinel spanning the two:

sanitizeSnippet('a\0markO<mark>hit</mark>b')
// → 'a<mark>markO\0hit</mark>b'

The genuine highlight moved, and with text on both sides it landed on text it was never meant to mark. No crafted sequence — one stray fragment ahead of any highlight.

The first revision of this description, and #391, both said the input had to carry the sentinel itself. That understated both the trigger and the consequence. An independent fuzzing pass over ~2.1M generated inputs found the prefix case; it is fixture-pinned now.

Not XSS — and the bound is the point

escapeHTML ran before the swap back, so content inside a forged region stayed escaped, and the emitted tag came from a fixed literal rather than a capture group — no attribute could land inside it:

sanitizeSnippet('\0markO\0 onload=alert(1)')
// → '<mark> onload=alert(1)'     the attribute lands outside, as text

Forgeable surface: the two strings <mark> and </mark>. No other tag, no attribute, no unescaped content. The consequence is spoofed emphasis, relocated highlights, and unbalanced markup reaching v-html.

Reachability

sanitizeSnippet is fed from result.snippets.title / .content in useContentSearch.ts:141,144, whose values come from whatever search function the host application passes to <ContentSearch>, and reaches v-html at CommandPalette.vue:623,649.

Fix

Split on the real tags instead of guessing a placeholder. Nothing is guessed, so nothing can collide.

Independently fuzzed at ~2.1M inputs against both the old implementation and a hand-written reference scanner that uses neither split nor replaceAll: no bypass, no unescaped character, no tag other than the two literals, and every old/new divergence traced to this defect family. The regex has no quantifiers; growth measured linear to 61MB, and at realistic snippet size the cost is 2.48µs against the old 1.78µs per call.

Tests

Five added. Mutation-checked by running each against the suite:

mutation	failing tests
regex capture dropped, so tags vanish from the output	6
closing-tag half of the condition dropped	6
tags escaped along with everything else	6
old placeholder implementation restored	4 — exactly the forgery cases

One of the five pins the bound rather than the bug — a forged tag could never carry an attribute — so a future rewrite cannot widen that without failing.

vitest run test/utils/ test/components/ → 6093 passed, 6 skipped, 255 files. eslint and vue-tsc --noEmit clean.

Corrections made during review

• The defect description understated the trigger and the consequence (above).
• An earlier revision of this table claimed 4/4/4/3. Both that and a reviewer's independent estimate of 2/2/2/3 were wrong; the numbers above come from applying each mutation and reading the failures from the JSON reporter. The first figure came from a name-extraction bug — the test names contain <mark>, and the extraction split on >.

Provenance

Pre-existing since 557a5178, the original port; untouched by #365, #371 and #388. Found by an independent security review pass over #371. The function came from upstream unchanged, so nuxt/ui very likely carries this too — not reported there.

Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.