searxng/searx/templates/simple/macros.html, branch customFree internet metasearch engine which aggregates results from various search services and databaseshttps://git.ikboikov.net/searxng/atom?h=custom2026-05-06T07:29:20Z[mod] result templates: move iframe to macro and fix page rendering for non-YouTube links (#5960)2026-05-06T07:29:20ZBnyrobnyro@tutanota.com2026-05-06T07:29:20Zurn:sha1:330d56bba9dfc1c7cfd1bcf027d092bc73d1ed10
This PR moves the `iframe` logic into a macro, so that `videos.html` and `general.html` both can benefit from the workaround to fix YouTube results by @return42 in https://github.com/searxng/searxng/pull/5858
It also fixes that only YouTube videos contained the closing `>` after `<iframe border="0" ...`, the regression has been caused by https://github.com/searxng/searxng/pull/5858
## Why is this change important?
Currently, the page breaks if there's any non-YouTube Iframe
Here, the page ends in the middle of the results and the footer and page number selector are not visible.Fix XSS via unsafe rendering of untrusted external data in templates (#5826)2026-03-13T12:28:31ZRenaud Allardrenaud@allard.it2026-03-13T12:28:31Zurn:sha1:23fb76f08f9e1e78247601d5d86b6b79aece1e63
Remove |safe filter from 6 template locations where data from external
search engine APIs was rendered as raw HTML without sanitization. Jinja2
autoescape now properly escapes these fields.
The |safe filter was originally added in commit 213041adc (March 2021)
by copying the pattern from result.title|safe and result.content|safe.
However, title and content are pre-escaped via escape() in webapp.py
lines 704-706 before highlight_content() adds trusted <span> tags for
search term highlighting. The metadata, info.value, link.url_label,
repository, and filename fields never go through any escaping and flow
directly from external API responses to the template.
Affected templates and their untrusted data sources:
- macros.html: result.metadata from DuckDuckGo, Reuters, Presearch,
Podcast Index, Fyyd, bpb, moviepilot, mediawiki, and others
- paper.html: result.metadata from academic search engines
- map.html: info.value and link.url_label from OpenStreetMap
user-contributed extratags
- code.html: result.repository and result.filename from GitHub API
Example exploit: a search engine API returning
metadata='<img src=x onerror=alert(document.cookie)>' would execute
arbitrary JavaScript in every user's browser viewing that result.[feat] video results: display video length on video thumbnail2025-10-17T13:59:53ZBnyrobnyro@tutanota.com2025-10-12T18:18:10Zurn:sha1:636738779eb3af5b2756473c7123586d6f72222c[enh] tidy: clean old morty, filtron, searx references2025-05-13T08:37:02ZIvan Gabaldonigabaldon@inetol.net2025-04-05T08:59:07Zurn:sha1:2cfd3fc44b16e7f3c6010c0ac1004efb6dacf382
Everyone should have already switched from legacy methods
[web-client] simple theme: refactor jinja_svg_catalog and cleanup icon names2025-02-28T11:27:41ZMarkus Heisermarkus.heiser@darmarit.de2025-02-04T14:59:02Zurn:sha1:189dd0155df60c98b5d7de73b873c8ad444ff931
This patch implements the template generation of the template:
searx/templates/simple/icons.html
by the way the icon set (the icon names) has been normalized:
film-outline --> film
magnet-outline --> magnet
..
warning --> alert
Some missing (categorie) icons had been added.
Some of the ionicons are not suitable for a dark theme, we fixed the svg
manually in src/svg/ionicons:
- https://github.com/searxng/searxng/pull/4284#issuecomment-2680550342
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
[chore] cleanup2024-12-16T07:32:35ZZhijie Hehezhijie0327@hotmail.com2024-12-14T08:35:25Zurn:sha1:8d2c01e4ce8d64b477d538c4bd7409e3524a376d[enh] add `engine-` prefix, replace blank space to `-`2024-12-16T07:32:35ZZhijie Hehezhijie0327@hotmail.com2024-12-14T08:06:56Zurn:sha1:12c27f416f72dc654ca1a2e2123014b4bb464cc1[fix]: fix engine name may break some css style, contains "right", "left", "center"2024-12-16T07:32:35ZZhijie Hehezhijie0327@hotmail.com2024-12-14T03:20:09Zurn:sha1:e90fa48018a35898c17de55c83c527766e6524e9[mod] favicons: simplify RTL in template & CSS2024-10-05T06:18:28ZMarkus Heisermarkus.heiser@darmarit.de2024-10-02T16:06:29Zurn:sha1:a631f77401a0a20ae98ae472482d0e4b912d4c60
Comes from a sughgestion in:
- https://github.com/searxng/searxng/pull/3727#issuecomment-2388998803
Suggested-by: Bnyro <bnyro@tutanota.com>
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
[mod] Revision of the favicon solution2024-10-05T06:18:28ZMarkus Heisermarkus.heiser@darmarit.de2024-08-19T15:47:54Zurn:sha1:7ab577a1fba43578b77f56b76275d0e65d03b318
All favicons implementations have been documented and moved to the Python
package:
searx.favicons
There is a configuration (based on Pydantic) for the favicons and all its
components:
searx.favicons.config
A solution for caching favicons has been implemented:
searx.favicon.cache
If the favicon is already in the cache, the returned URL is a data URL [1]
(something like `data:image/png;base64,...`). By generating a data url from
the FaviconCache, additional HTTP roundtripps via the favicon_proxy are saved:
favicons.proxy.favicon_url
The favicon proxy service now sets a HTTP header "Cache-Control: max-age=...":
favicons.proxy.favicon_proxy
The resolvers now also provide the mime type (data, mime):
searx.favicon.resolvers
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>