Fix xss vulnerability

CHANGELOG.md

@@ -3,6 +3,26 @@
 ### Features
 
 ### Fixes
+<<<<<<< HEAD
+=======
+- [#4713](https://github.com/blockscout/blockscout/pull/4713) - Search input field: sanitize input
+- [#4703](https://github.com/blockscout/blockscout/pull/4703) - Block Details page: Fix pagination on the Transactions tab
+- [#4686](https://github.com/blockscout/blockscout/pull/4686) - Block page: check gas limit value before division
+- [#4678](https://github.com/blockscout/blockscout/pull/4678) - Internal transactions indexer: fix issue of some pending transactions never become confirmed
+- [#4668](https://github.com/blockscout/blockscout/pull/4668) - Fix css for dark theme
+- [#4654](https://github.com/blockscout/blockscout/pull/4654) - AddressView: Change `@burn_address` to string `0x0000000000000000000000000000000000000000`
+- [#4626](https://github.com/blockscout/blockscout/pull/4626) - Refine view of popup for reverted tx
+- [#4640](https://github.com/blockscout/blockscout/pull/4640) - Token page: fixes in mobile view
+- [#4612](https://github.com/blockscout/blockscout/pull/4612) - Hide error selector in the contract's functions list
+- [#4615](https://github.com/blockscout/blockscout/pull/4615) - Fix broken style for `View more transfers` button
+- [#4592](https://github.com/blockscout/blockscout/pull/4592) - Add `type` field for `receive` and `fallback` entities of a Smart Contract
+- [#4601](https://github.com/blockscout/blockscout/pull/4601) - Fix endless Fetching tokens... message on empty addresses
+- [#4591](https://github.com/blockscout/blockscout/pull/4591) - Add step and min value for txValue input field
+- [#4589](https://github.com/blockscout/blockscout/pull/4589) - Fix solid outputs on contract read page
+- [#4586](https://github.com/blockscout/blockscout/pull/4586) - Fix floating tooltips on the token transfer family blocks
+- [#4587](https://github.com/blockscout/blockscout/pull/4587) - Enable navbar menu on Search results page
+- [#4582](https://github.com/blockscout/blockscout/pull/4582) - Fix NaN input on write contract page
+>>>>>>> 9ca281448 (Search input: sanitize input)
 
 ### Chore
 

apps/block_scout_web/assets/js/lib/autocomplete.js

@@ -1,6 +1,7 @@
 import AutoComplete from '@tarekraafat/autocomplete.js/dist/autoComplete.js'
 import { getTextAdData, fetchTextAdData } from './ad.js'
 import { DateTime } from 'luxon'
+import xss from 'xss'
 
 const placeHolder = 'Search by address, token symbol, name, transaction hash, or block number'
 const dataSrc = async (query, id) => {
@@ -106,6 +107,9 @@ const config = (id) => {
       element: (item, data) => resultItemElement(item, data),
       highlight: 'autoComplete_highlight'
     },
+    query: (input) => {
+      return xss(input)
+    },
     events: {
       input: {
         focus: () => {