Search results can cause browser navigation and other HTML processing

decade6331

Perform a search that results in a result returning that has HTML as part of the site description metadata. For example, "html redirect" (https://kagi.com/search?q=html+redirect)
Observe that the page instantly navigates to a different website after results load, because one of the sites, Conductor, includes "<meta http-equiv="refresh" content="0; url=$URL">" within the description.

This is, in my view, a fairly risky issue, because it enables any site that gets returned to effectively hijack user navigation.
From the API, this is how the result looks
{ "url": "https://www.conductor.com/academy/redirects/faq/html-meta-redirect/", "title": "HTML redirect code: the meta refresh explained - Conductor", "snippet": "The <strong>HTML</strong> <strong>redirect</strong> code you're looking for is called the "meta refresh element": <meta http-equiv="refresh" content="0; url=$URL">.", "props": { "group_id": "conductor.com" } },

Normal search results page, for the page to not redirect.

FirstNameLastName

Can confirm this happens only in the “Kagi Search” application. Which I think means Android only.

Orion and the Kagi search engine themselves don't cause.

For some reason I can’t try Kagi for Safari as it doesn’t allow me to enable extensions but would be shocked if it happened there, as I’m positive the extension and safari wouldn’t cause this behaviour and that it’s exclusive to how the Kagi Search App implements it.

Definitely is a security issue.
“HTML redirect” when searched on Kagi Search takes me directly to “intternet.dev”
Which is luckily just a normal website with some dev articles written by somebody.

But it stands to reason this can be abused by bad actors.

I wonder if it possibly extends into the realm of Arbitrary Code Execution.
Definitely a high priority fix especially if there’s any possibility of ACE or RCE.

mb

decade6331 FirstNameLastName I'm not able to reproduce this using the Kagi Search app for Android nor Firefox.

pixel

I can reproduce this in my browser, thanks for reporting.

pixel

This has been fixed. Thanks!