Merge pull request #880 from PR0M3TH3AN/fix/docs-search-xss-13126955051571553901

Fix XSS in docs search highlighting

docs/assets/theme.js

@@ -46,9 +46,26 @@ document.addEventListener('DOMContentLoaded', () => {
     }
   }
 
+  function escapeHtml(text) {
+    if (!text) return text;
+    return text
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&#039;");
+  }
+
   function highlight(text, q) {
+    if (!q) return escapeHtml(text);
     const re = new RegExp('(' + q.replace(/[.*+?^${}()|[\\]\\]/g, '\\$&') + ')', 'gi');
-    return text.replace(re, '<mark>$1</mark>');
+    return text.split(re).map((part, index) => {
+      if (index % 2 === 1) {
+        return '<mark>' + escapeHtml(part) + '</mark>';
+      } else {
+        return escapeHtml(part);
+      }
+    }).join('');
   }
 
   searchInput?.addEventListener('input', async e => {

torch/src/todo/TODO_2026-02-16T11-47-38Z.md

@@ -0,0 +1,5 @@
+# TODO: bug-reproducer-agent run 2026-02-16T11:47:38Z
+
+- Agent: bug-reproducer-agent
+- Status: Completed
+- Resolution: Fixed XSS vulnerability in docs/assets/theme.js