Fixed search terms not highlightfix-search-not-highlighting

Closes #31997

3 files changed, 47 insertions, 10 deletions

diff --git a/app/assets/javascripts/gl_dropdown.js b/app/assets/javascripts/gl_dropdown.js
index 2eee989bffe..9666eeeb5ad 100644
--- a/app/assets/javascripts/gl_dropdown.js
+++ b/app/assets/javascripts/gl_dropdown.js
@@ -608,7 +608,12 @@ GitLabDropdown = (function() {
       var link = document.createElement('a');
 
       link.href = url;
-      link.innerHTML = text;
+
+      if (this.highlight) {
+        link.innerHTML = text;
+      } else {
+        link.textContent = text;
+      }
 
       if (selected) {
         link.className = 'is-active';
diff --git a/changelogs/unreleased/fix-search-not-highlighting.yml b/changelogs/unreleased/fix-search-not-highlighting.yml
new file mode 100644
index 00000000000..a624530ebd1
--- /dev/null
+++ b/changelogs/unreleased/fix-search-not-highlighting.yml
@@ -0,0 +1,4 @@
+---
+title: Fixed search terms not correctly highlighting
+merge_request:
+author:
diff --git a/spec/javascripts/gl_dropdown_spec.js b/spec/javascripts/gl_dropdown_spec.js
index c207fb00a47..eb532dff5a1 100644
--- a/spec/javascripts/gl_dropdown_spec.js
+++ b/spec/javascripts/gl_dropdown_spec.js
@@ -44,21 +44,18 @@ require('~/lib/utils/url_utility');
     preloadFixtures('static/gl_dropdown.html.raw');
     loadJSONFixtures('projects.json');
 
-    function initDropDown(hasRemote, isFilterable) {
-      this.dropdownButtonElement = $('#js-project-dropdown', this.dropdownContainerElement).glDropdown({
+    function initDropDown(hasRemote, isFilterable, extraOpts = {}) {
+      const options = Object.assign({
         selectable: true,
         filterable: isFilterable,
         data: hasRemote ? remoteMock.bind({}, this.projectsData) : this.projectsData,
         search: {
           fields: ['name']
         },
-        text: (project) => {
-          (project.name_with_namespace || project.name);
-        },
-        id: (project) => {
-          project.id;
-        }
-      });
+        text: project => (project.name_with_namespace || project.name),
+        id: project => project.id,
+      }, extraOpts);
+      this.dropdownButtonElement = $('#js-project-dropdown', this.dropdownContainerElement).glDropdown(options);
     }
 
     beforeEach(() => {
@@ -80,6 +77,37 @@ require('~/lib/utils/url_utility');
       expect(this.dropdownContainerElement).toHaveClass('open');
     });
 
+    it('escapes HTML as text', () => {
+      this.projectsData[0].name_with_namespace = '<script>alert("testing");</script>';
+
+      initDropDown.call(this, false);
+
+      this.dropdownButtonElement.click();
+
+      expect(
+        $('.dropdown-content li:first-child').text(),
+      ).toBe('<script>alert("testing");</script>');
+    });
+
+    it('should output HTML when highlighting', () => {
+      this.projectsData[0].name_with_namespace = 'testing';
+      $('.dropdown-input .dropdown-input-field').val('test');
+
+      initDropDown.call(this, false, true, {
+        highlight: true,
+      });
+
+      this.dropdownButtonElement.click();
+
+      expect(
+        $('.dropdown-content li:first-child').text(),
+      ).toBe('testing');
+
+      expect(
+        $('.dropdown-content li:first-child a').html(),
+      ).toBe('<b>t</b><b>e</b><b>s</b><b>t</b>ing');
+    });
+
     describe('that is open', () => {
       beforeEach(() => {
         initDropDown.call(this, false, false);