Issue with plugin install pagination

[praful2111]

When users search for any plugin with any special character(&) and click on pagination page 2 the URL will consider new parameters after the &.

Here is the video link - ​https://www.awesomescreenshot.com/video/10352796?key=68a9c344d22c2b84328dcfd7da152c19

[praful2111]

I have updated admin side plugin js

[audrasjb]

Hello, thank you for the ticket and patch!

Moving for 6.1 consideration.

Maybe event.target.value should be sanitized before/outside of the value assignment?

[praful2111]

@audrasjb No directly passing the value under the funcation, Not sanitized before/outside of the funcation.

[costdev]

I can verify that the issue exists and that the patch fixes one instance of &.

To deal with all instances of &, for example, search & replace & search again the replace() call should be changed to:

event.target.value.replace( /&/g, '%26' )

[audrasjb]

I'm not a specialist, but maybe it's better to use something like encodeURIComponent?

[audrasjb]

Tested with:

const uri = 'test&test';
const encoded = encodeURIComponent(uri);
console.log(uri);
console.log(encoded);

> "test&test"
> "test%26test"

[costdev]

Good call @audrasjb, that seems to work just fine with multiple & and with various additional characters.

[praful2111]

I have sensitize value

[audrasjb]

Before patch: query string not encoded

[audrasjb]

After patch: query string properly encoded

Trac ticket: https://core.trac.wordpress.org/ticket/56339

[audrasjb]

I added a PR to fix a small Coding standards issue in the previous patch, add also to add a missing occurence.

@costdev @praful2111 looks good to you?

LGTM 👍

[praful2111]

Looks good to me

[audrasjb]

In 53844:

Plugins: Properly encode query string s parameter in plugin search.

This ensures special characters like & are properly encoded when passed as URL parameter.

Props praful2111, audrasjb, costdev.
Fixes #56339.

Committed in https://core.trac.wordpress.org/changeset/53844