[gnome-shell] util: Properly handle markup in highlighter

[Marge Bot <marge-bot src gnome org>]

commit 3d8b866a9d5e432f12d5bce9a65e61dc97b26d99
Author: Sebastian Keller <skeller gnome org>
Date:   Wed Nov 17 02:50:39 2021 +0100

    util: Properly handle markup in highlighter
    
    The code to highlight matches did not properly escape the passed in text
    as for markup before adding its highlighting markup. This lead to some
    search result descriptions not showing up, because their descriptions
    contained characters, such as "<", that would have to be escaped when
    used in markup or otherwise lead to invalid markup.
    
    To work around this some search providers wrongly started escaping the
    description on their end before sending them to gnome-shell. This lead
    to another issue. Now if the highlighter was trying to highlight the
    term "a", and the escaped description contained "&apos;", the "a" in
    that would be considered a match and surrounded by "<b></b>". This
    however would also generate invalid markup, again leading to an error
    and the description not being shown.
    
    Fix this by always escaping the passed in string before applying the
    highlights in such a way that there are no matches within entities.
    
    This also means that search providers that escaped their description
    strings will now show up with the markup syntax. This will have to be
    fixed separately in the affected search providers.
    
    Fixes: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/4791
    Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2033>

 js/misc/util.js | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)
---
diff --git a/js/misc/util.js b/js/misc/util.js
index 183b84b7a2..6a0f6f6414 100644
--- a/js/misc/util.js
+++ b/js/misc/util.js
@@ -585,8 +585,25 @@ var Highlighter = class {
      */
     highlight(text) {
         if (!this._highlightRegex)
-            return text;
+            return GLib.markup_escape_text(text, -1);
+
+        let escaped = [];
+        let lastMatchEnd = 0;
+        let match;
+        while ((match = this._highlightRegex.exec(text))) {
+            if (match.index > lastMatchEnd) {
+                let unmatched = GLib.markup_escape_text(
+                    text.slice(lastMatchEnd, match.index), -1);
+                escaped.push(unmatched);
+            }
+            let matched = GLib.markup_escape_text(match[0], -1);
+            escaped.push('<b>%s</b>'.format(matched));
+            lastMatchEnd = match.index + match[0].length;
+        }
+        let unmatched = GLib.markup_escape_text(
+            text.slice(lastMatchEnd), -1);
+        escaped.push(unmatched);
 
-        return text.replace(this._highlightRegex, '<b>$1</b>');
+        return escaped.join('');
     }
 };