From 32f0931867bc293b7c95d21672869572e400e65c Mon Sep 17 00:00:00 2001
From: Yanzhu Li <yanzhu.li@mapbox.com>
Date: Wed, 14 Oct 2026 17:11:03 +0200
Subject: [PATCH] Fall back to default renderer when render is not a function

---
 .gitignore            |  3 ++-
 API.md                |  2 +-
 CHANGELOG.md          |  4 ++++
 lib/index.js          |  7 +++----
 test/test.geocoder.js | 24 ++++++++++++++++++++++++
 5 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 54797655..de7c2d9b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 env.test.sh
 dist
-node_modules
\ No newline at end of file
+node_modules
+.idea
diff --git a/API.md b/API.md
index 69d258d4..1e472929 100644
--- a/API.md
+++ b/API.md
@@ -214,7 +214,7 @@ Set the render function used in the results dropdown
 
 #### Parameters
 
-*   `fn` **[Function][85]** The function to use as a render function. This function accepts a single [extended GeoJSON][86] object as input and returns a string.
+*   `fn` **[Function][85]** The function to use as a render function. This function accepts a single [extended GeoJSON][86] object as input and returns a string. If `fn` is not a function, the default render function is used.
 
 Returns **[MapboxGeocoder][2]** this
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f4103fe..37e76299 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 ## HEAD
 
+### Bug fixes 🐛
+
+- Fix potential XSS when the `render` option is not a function.
+
 ## 5.1.2
 
 ### Bug fixes 🐛
diff --git a/lib/index.js b/lib/index.js
index 23eabdbd..21293e28 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -1121,13 +1121,12 @@ MapboxGeocoder.prototype = {
 
   /**
    * Set the render function used in the results dropdown
-   * @param {Function} fn The function to use as a render function. This function accepts a single [extended GeoJSON](https://docs.mapbox.com/api/search/geocoding-v5/#geocoding-response-object) object as input and returns a string.
+   * @param {Function} fn The function to use as a render function. This function accepts a single [extended GeoJSON](https://docs.mapbox.com/api/search/geocoding-v5/#geocoding-response-object) object as input and returns a string. If `fn` is not a function, the default render function is used.
    * @returns {MapboxGeocoder} this
    */
   setRenderFunction: function(fn){
-    if (fn && typeof(fn) == "function"){
-      this._typeahead.render = fn;
-    }
+    // Fall back to the escaping default: keeping the suggestions library's own renderer would inject place_name unescaped
+    this._typeahead.render = typeof fn === 'function' ? fn : MapboxGeocoder.prototype.options.render;
     return this;
   },
 
diff --git a/test/test.geocoder.js b/test/test.geocoder.js
index d2c5611e..8fbc6c7c 100644
--- a/test/test.geocoder.js
+++ b/test/test.geocoder.js
@@ -706,6 +706,30 @@ test('geocoder', function(tt) {
     t.equals(geocoder._typeahead.render(fixture), 'feature id is abc123', 'render function is applied properly on the typeahead');
   })
 
+  tt.test('default render function escapes place_name', function(t){
+    t.plan(2);
+    var html = MapboxGeocoder.prototype.options.render({ place_name: '<img src=x>Cafe, Berlin' });
+    t.ok(html.indexOf('&lt;img src=x&gt;Cafe') > -1, 'place_name is escaped');
+    t.equals(html.indexOf('<img'), -1, 'no raw HTML from place_name');
+  });
+
+  // Compare by identity: calling the suggestions library's renderer directly loops forever on its initial empty query
+  tt.test('options.render that is not a function falls back to the default', function(t){
+    var values = [undefined, null, false, 'not a function'];
+    t.plan(values.length);
+    values.forEach(function(value){
+      setup({ render: value });
+      t.equals(geocoder.getRenderFunction(), MapboxGeocoder.prototype.options.render, 'default render function is used when render is ' + String(value));
+    });
+  });
+
+  tt.test('setRenderFunction with non-function input restores the default', function(t){
+    t.plan(1);
+    setup({ render: function(item){ return item.place_name; } });
+    geocoder.setRenderFunction(null);
+    t.equals(geocoder.getRenderFunction(), MapboxGeocoder.prototype.options.render, 'default render function is used');
+  });
+
   tt.test('setRenderFunction with no input', function(t){
     t.plan(2);
     setup({});