HTML search: represent indices using JavaScript Map instead of object literals

CHANGES.rst

@@ -23,6 +23,9 @@ Bugs fixed
 
 * #13060: HTML Search: use ``Map`` to store per-file term scores.
   Patch by James Addison
+* #13097: HTML Search: add a precautionary check for query term
+  presence in index properties before accessing them.
+  Patch by James Addison
 
 Testing
 -------

sphinx/search/__init__.py

@@ -164,8 +164,8 @@ class _JavaScriptIndex:
     on the documentation search object to register the index.
     """
 
-    PREFIX = 'Search.setIndex('
-    SUFFIX = ')'
+    PREFIX = "Search.setIndex('"
+    SUFFIX = "')"
 
     def dumps(self, data: Any) -> str:
         data_json = json.dumps(data, separators=(',', ':'), sort_keys=True)

sphinx/themes/basic/static/searchtools.js

@@ -219,7 +219,8 @@ const Search = {
     (document.body.appendChild(document.createElement("script")).src = url),
 
   setIndex: (index) => {
-    Search._index = index;
+    const reviver = (k, v) => (typeof v === "object" && v !== null) ? Object.freeze(v) : v;
+    Search._index = JSON.parse(index, reviver);
     if (Search._queued_query !== null) {
       const query = Search._queued_query;
       Search._queued_query = null;
@@ -513,9 +514,11 @@ const Search = {
     // perform the search on the required terms
     searchTerms.forEach((word) => {
       const files = [];
+      // find documents, if any, containing the query word in their text/title term indices
+      // use Object.hasOwnProperty to avoid mismatching against prototype properties
       const arr = [
-        { files: terms[word], score: Scorer.term },
-        { files: titleTerms[word], score: Scorer.title },
+        { files: terms.hasOwnProperty(word) ? terms[word] : undefined, score: Scorer.term },
+        { files: titleTerms.hasOwnProperty(word) ? titleTerms[word] : undefined, score: Scorer.title },
       ];
       // add support for partial matches
       if (word.length > 2) {

tests/js/roots/ecmascript/index.rst

@@ -0,0 +1,6 @@
+ECMAScript
+----------
+
+This is a sample JavaScript (aka ``ECMAScript``) project used to generate a search engine index fixture.
+
+Use the `__proto__` property to access the `prototype <https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Objects/Object_prototypes>`_ (if any) of an object instance.

tests/js/searchtools.spec.js

@@ -209,6 +209,38 @@ describe('Basic html theme search', function() {
 
   });
 
+  describe('can handle edge-case search queries', function() {
+
+    it('can search for the javascript prototype property', function() {
+      eval(loadFixture("ecmascript/searchindex.js"));
+
+      searchParameters = Search._parseQuery('__proto__');
+
+      hits = [
+        [
+          'index',
+          'ECMAScript',
+          '',
+          null,
+          5,
+          'index.rst',
+          'text'
+        ]
+      ];
+      expect(Search._performSearch(...searchParameters)).toEqual(hits);
+    });
+
+    it('does not find the javascript prototype property in unrelated documents', function() {
+      eval(loadFixture("partial/searchindex.js"));
+
+      searchParameters = Search._parseQuery('__proto__');
+
+      hits = [];
+      expect(Search._performSearch(...searchParameters)).toEqual(hits);
+    });
+
+  });
+
 });
 
 describe("htmlToText", function() {

tests/test_search.py

@@ -67,7 +67,7 @@ def load_searchindex(path: Path) -> Any:
     assert searchindex.startswith('Search.setIndex(')
     assert searchindex.endswith(')')
 
-    return json.loads(searchindex[16:-1])
+    return json.loads(searchindex[17:-2])
 
 
 def is_registered_term(index: Any, keyword: str) -> bool: