Escape search query

app/javascript/maps/location_search.js

@@ -321,7 +321,7 @@ class LocationSearch {
     this.resultsContainer.innerHTML = `
       <div class="p-8 text-center">
         <div class="inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-blue-500"></div>
-        <div class="text-sm text-gray-600 mt-3">Searching for "${this.currentSearchQuery}"...</div>
+        <div class="text-sm text-gray-600 mt-3">Searching for "${this.escapeHtml(this.currentSearchQuery)}"...</div>
       </div>
     `;
   }
@@ -335,7 +335,7 @@ class LocationSearch {
       <div class="p-8 text-center">
         <div class="text-4xl mb-3">⚠️</div>
         <div class="text-sm font-medium text-red-600 mb-2">Search Failed</div>
-        <div class="text-xs text-gray-500">${message}</div>
+        <div class="text-xs text-gray-500">${this.escapeHtml(message)}</div>
       </div>
     `;
   }
@@ -350,7 +350,7 @@ class LocationSearch {
         <div class="p-6 text-center text-gray-500">
           <div class="text-3xl mb-3">📍</div>
           <div class="text-sm font-medium">No visits found</div>
-          <div class="text-xs mt-1">No visits found for "${this.currentSearchQuery}"</div>
+          <div class="text-xs mt-1">No visits found for "${this.escapeHtml(this.currentSearchQuery)}"</div>
         </div>
       `;
       return;
@@ -362,7 +362,7 @@ class LocationSearch {
     let resultsHtml = `
       <div class="p-4 border-b bg-gray-50">
         <div class="text-sm font-medium text-gray-700">Found ${data.total_locations} location(s)</div>
-        <div class="text-xs text-gray-500 mt-1">for "${this.currentSearchQuery}"</div>
+        <div class="text-xs text-gray-500 mt-1">for "${this.escapeHtml(this.currentSearchQuery)}"</div>
       </div>
     `;
 

app/services/location_search/geocoding_service.rb

@@ -33,10 +33,15 @@ module LocationSearch
     end
 
     def normalize_geocoding_results(results)
-      normalized_results = results.map do |result|
+      normalized_results = results.filter_map do |result|
+        lat = result.latitude.to_f
+        lon = result.longitude.to_f
+
+        next unless valid_coordinates?(lat, lon)
+
         {
-          lat: result.latitude.to_f,
-          lon: result.longitude.to_f,
+          lat: lat,
+          lon: lon,
           name: result.address&.split(',')&.first || 'Unknown location',
           address: result.address || '',
           type: result.data&.dig('type') || result.data&.dig('class') || 'unknown',
@@ -83,5 +88,9 @@ module LocationSearch
 
       distance_km * 1000 # Convert km to meters
     end
+
+    def valid_coordinates?(lat, lon)
+      lat.between?(-90, 90) && lon.between?(-180, 180)
+    end
   end
 end

app/services/location_search/point_finder.rb

@@ -13,6 +13,8 @@ module LocationSearch
     end
 
     def call
+      return empty_result unless valid_coordinates?
+
       location = {
         lat: @latitude,
         lon: @longitude,
@@ -103,5 +105,18 @@ module LocationSearch
         500  # Default radius for unknown types
       end
     end
+
+    def valid_coordinates?
+      @latitude.present? && @longitude.present? &&
+        @latitude.to_f.between?(-90, 90) && @longitude.to_f.between?(-180, 180)
+    end
+
+    def empty_result
+      {
+        locations: [],
+        total_locations: 0,
+        search_metadata: {}
+      }
+    end
   end
 end

spec/jobs/data_migrations/migrate_points_latlon_job_spec.rb

@@ -8,9 +8,12 @@ RSpec.describe DataMigrations::MigratePointsLatlonJob, type: :job do
       user = create(:user)
       point = create(:point, latitude: 2.0, longitude: 1.0, user: user)
       
+      # Clear the lonlat to simulate points that need migration
+      point.update_column(:lonlat, nil)
+
       expect { subject.perform(user.id) }.to change {
         point.reload.lonlat
-      }.to(RGeo::Geographic.spherical_factory.point(1.0, 2.0))
+      }.from(nil).to(RGeo::Geographic.spherical_factory.point(1.0, 2.0))
     end
   end
 end