Fall back to default renderer when render is not a function

.gitignore

@@ -1,3 +1,4 @@
 env.test.sh
 dist
-node_modules
+node_modules
+.idea

API.md

@@ -214,7 +214,7 @@ Set the render function used in the results dropdown
 
 #### Parameters
 
-*   `fn` **[Function][85]** The function to use as a render function. This function accepts a single [extended GeoJSON][86] object as input and returns a string.
+*   `fn` **[Function][85]** The function to use as a render function. This function accepts a single [extended GeoJSON][86] object as input and returns a string. If `fn` is not a function, the default render function is used.
 
 Returns **[MapboxGeocoder][2]** this
 

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## HEAD
 
+### Bug fixes 🐛
+
+- Fix potential XSS when the `render` option is not a function.
+
 ## 5.1.2
 
 ### Bug fixes 🐛

lib/index.js

@@ -1121,13 +1121,12 @@ MapboxGeocoder.prototype = {
 
   /**
    * Set the render function used in the results dropdown
-   * @param {Function} fn The function to use as a render function. This function accepts a single [extended GeoJSON](https://docs.mapbox.com/api/search/geocoding-v5/#geocoding-response-object) object as input and returns a string.
+   * @param {Function} fn The function to use as a render function. This function accepts a single [extended GeoJSON](https://docs.mapbox.com/api/search/geocoding-v5/#geocoding-response-object) object as input and returns a string. If `fn` is not a function, the default render function is used.
    * @returns {MapboxGeocoder} this
    */
   setRenderFunction: function(fn){
-    if (fn && typeof(fn) == "function"){
-      this._typeahead.render = fn;
-    }
+    // Fall back to the escaping default: keeping the suggestions library's own renderer would inject place_name unescaped
+    this._typeahead.render = typeof fn === 'function' ? fn : MapboxGeocoder.prototype.options.render;
     return this;
   },
 

test/test.geocoder.js

@@ -706,6 +706,30 @@ test('geocoder', function(tt) {
     t.equals(geocoder._typeahead.render(fixture), 'feature id is abc123', 'render function is applied properly on the typeahead');
   })
 
+  tt.test('default render function escapes place_name', function(t){
+    t.plan(2);
+    var html = MapboxGeocoder.prototype.options.render({ place_name: '<img src=x>Cafe, Berlin' });
+    t.ok(html.indexOf('&lt;img src=x&gt;Cafe') > -1, 'place_name is escaped');
+    t.equals(html.indexOf('<img'), -1, 'no raw HTML from place_name');
+  });
+
+  // Compare by identity: calling the suggestions library's renderer directly loops forever on its initial empty query
+  tt.test('options.render that is not a function falls back to the default', function(t){
+    var values = [undefined, null, false, 'not a function'];
+    t.plan(values.length);
+    values.forEach(function(value){
+      setup({ render: value });
+      t.equals(geocoder.getRenderFunction(), MapboxGeocoder.prototype.options.render, 'default render function is used when render is ' + String(value));
+    });
+  });
+
+  tt.test('setRenderFunction with non-function input restores the default', function(t){
+    t.plan(1);
+    setup({ render: function(item){ return item.place_name; } });
+    geocoder.setRenderFunction(null);
+    t.equals(geocoder.getRenderFunction(), MapboxGeocoder.prototype.options.render, 'default render function is used');
+  });
+
   tt.test('setRenderFunction with no input', function(t){
     t.plan(2);
     setup({});