Searchbox widget - XSS vulnerability in search results

[Redirod]

Here is the input we get in the searchbox view:

<input type="search" title="@Html.Resource("SearchInput")" placeholder="@Model.BackgroundHint" id="@Html.Raw(searchTextBoxId)" class="form-control" value="@Html.Raw(ViewBag.SearchQuery)"/>

The 'value="@Html.Raw(ViewBag.SearchQuery)" ' presents an xss vulnerability.
This security issue allows writing query strings within the input field.

Example:
Create a page using this widget. open the page on firefox and add this to the input field:

test" onclick="alert('hello xss vulnerability')" class=

search and then click on the input field.

[dboyanov]

No longer valid. The value does not contain Html.Raw.