Fixed search terms not highlight

Closes #31997

app/assets/javascripts/gl_dropdown.js

@@ -608,7 +608,12 @@ GitLabDropdown = (function() {
       var link = document.createElement('a');
 
       link.href = url;
+
+      if (this.highlight) {
         link.innerHTML = text;
+      } else {
+        link.textContent = text;
+      }
 
       if (selected) {
         link.className = 'is-active';

changelogs/unreleased/fix-search-not-highlighting.yml

+---
+title: Fixed search terms not correctly highlighting
+merge_request:
+author:

spec/javascripts/gl_dropdown_spec.js

@@ -44,21 +44,18 @@ require('~/lib/utils/url_utility');
     preloadFixtures('static/gl_dropdown.html.raw');
     loadJSONFixtures('projects.json');
 
-    function initDropDown(hasRemote, isFilterable) {
-      this.dropdownButtonElement = $('#js-project-dropdown', this.dropdownContainerElement).glDropdown({
+    function initDropDown(hasRemote, isFilterable, extraOpts = {}) {
+      const options = Object.assign({
         selectable: true,
         filterable: isFilterable,
         data: hasRemote ? remoteMock.bind({}, this.projectsData) : this.projectsData,
         search: {
           fields: ['name']
         },
-        text: (project) => {
-          (project.name_with_namespace || project.name);
-        },
-        id: (project) => {
-          project.id;
-        }
-      });
+        text: project => (project.name_with_namespace || project.name),
+        id: project => project.id,
+      }, extraOpts);
+      this.dropdownButtonElement = $('#js-project-dropdown', this.dropdownContainerElement).glDropdown(options);
     }
 
     beforeEach(() => {
@@ -80,6 +77,37 @@ require('~/lib/utils/url_utility');
       expect(this.dropdownContainerElement).toHaveClass('open');
     });
 
+    it('escapes HTML as text', () => {
+      this.projectsData[0].name_with_namespace = '<script>alert("testing");</script>';
+
+      initDropDown.call(this, false);
+
+      this.dropdownButtonElement.click();
+
+      expect(
+        $('.dropdown-content li:first-child').text(),
+      ).toBe('<script>alert("testing");</script>');
+    });
+
+    it('should output HTML when highlighting', () => {
+      this.projectsData[0].name_with_namespace = 'testing';
+      $('.dropdown-input .dropdown-input-field').val('test');
+
+      initDropDown.call(this, false, true, {
+        highlight: true,
+      });
+
+      this.dropdownButtonElement.click();
+
+      expect(
+        $('.dropdown-content li:first-child').text(),
+      ).toBe('testing');
+
+      expect(
+        $('.dropdown-content li:first-child a').html(),
+      ).toBe('<b>t</b><b>e</b><b>s</b><b>t</b>ing');
+    });
+
     describe('that is open', () => {
       beforeEach(() => {
         initDropDown.call(this, false, false);