Summary

• Searching with ?s= may trigger an XSS injection， escape the search str.
• Introducefunction stripUrlExceptId to ensure sidebar links only containsid as anchor.
  As-is

v4

v5 rc1

Related issue, if any:

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no api changes)
• Build related changes
• Documentation content changes
• Other (please describe):

For any code change,

• Related documentation has been updated, if needed
• Related tests have been added or updated, if needed

Does this PR introduce a breaking change?

• Yes
• No

Tested in the following browsers:

• Chrome
• Firefox
• Safari
• Edge