title: jQuery Combobox unsafe HTML insertion
body: <p>I tried to use <a href="http://jqueryui.com/demos/autocomplete/#combobox" rel="nofollow">jQuery combobox </a> (<a href="http://jsfiddle.net/juzerali/GjjQP/" rel="nofollow">fiddle</a>) in my Mozilla Firefox addon. But AMO editors rejected my Addon after reviewing stating that my javascript does unsafe HTML insertion with unsanitized data. Parts of the code stated as unsafe all belong to the code on official jQuery Ui <a href="http://jqueryui.com/demos/autocomplete/#combobox" rel="nofollow">page</a> for combobox. I am also writing the code below. Removing this piece of code throws error if I try to create a combobox.</p>
  
  <p>It makes me wonder why <code>combobox</code> isn't already included in jQuery and why do I have to put this snippet inside my code? Am I doing anything wrong here. Alternatively Can someone suggest me how can I make this code taken from official jquery page safe and sanitized?</p>
  
  <pre><code>(function( $ ) {
          $.widget( "ui.combobox", {
              _create: function() {
                  var self = this,
                      select = this.element.hide(),
                      selected = select.children( ":selected" ),
                      value = selected.val() ? selected.text() : "";
                  var input = this.input = $( "&lt;input&gt;" )
                      .insertAfter( select )
                      .val( value )
                      .autocomplete({
                          delay: 0,
                          minLength: 0,
                          source: function( request, response ) {
                              var matcher = new RegExp( $.ui.autocomplete.escapeRegex(request.term), "i" );
                              response( select.children( "option" ).map(function() {
                                  var text = $( this ).text();
                                  if ( this.value &amp;&amp; ( !request.term || matcher.test(text) ) )
                                      return {
                                          label: text.replace(
                                              new RegExp(
                                                  "(?![^&amp;;]+;)(?!&lt;[^&lt;&gt;]*)(" +
                                                  $.ui.autocomplete.escapeRegex(request.term) +
                                                  ")(?![^&lt;&gt;]*&gt;)(?![^&amp;;]+;)", "gi"
                                              ), "&lt;strong&gt;$1&lt;/strong&gt;" ),
                                          value: text,
                                          option: this
                                      };
                              }) );
                          },
                          select: function( event, ui ) {
                              ui.item.option.selected = true;
                              self._trigger( "selected", event, {
                                  item: ui.item.option
                              });
                          },
                          change: function( event, ui ) {
                              if ( !ui.item ) {
                                  var matcher = new RegExp( "^" + $.ui.autocomplete.escapeRegex( $(this).val() ) + "$", "i" ),
                                      valid = false;
                                  select.children( "option" ).each(function() {
                                      if ( $( this ).text().match( matcher ) ) {
                                          this.selected = valid = true;
                                          return false;
                                      }
                                  });
                                  if ( !valid ) {
                                      // remove invalid value, as it didn't match anything
                                      $( this ).val( "" );
                                      select.val( "" );
                                      input.data( "autocomplete" ).term = "";
                                      return false;
                                  }
                              }
                          }
                      })
                      .addClass( "ui-widget ui-widget-content ui-corner-left" );
  
                  input.data( "autocomplete" )._renderItem = function( ul, item ) {
                      return $( "&lt;li&gt;&lt;/li&gt;" )
                          .data( "item.autocomplete", item )
                          .append( "&lt;a&gt;" + item.label + "&lt;/a&gt;" )
                          .appendTo( ul );
                  };
  
                  this.button = $( "&lt;button type='button'&gt;&amp;nbsp;&lt;/button&gt;" )
                      .attr( "tabIndex", -1 )
                      .attr( "title", "Show All Items" )
                      .insertAfter( input )
                      .button({
                          icons: {
                              primary: "ui-icon-triangle-1-s"
                          },
                          text: false
                      })
                      .removeClass( "ui-corner-all" )
                      .addClass( "ui-corner-right ui-button-icon" )
                      .click(function() {
                          // close if already visible
                          if ( input.autocomplete( "widget" ).is( ":visible" ) ) {
                              input.autocomplete( "close" );
                              return;
                          }
  
                          // work around a bug (likely same cause as #5265)
                          $( this ).blur();
  
                          // pass empty string as value to search for, displaying all results
                          input.autocomplete( "search", "" );
                          input.focus();
                      });
              },
  
              destroy: function() {
                  this.input.remove();
                  this.button.remove();
                  this.element.show();
                  $.Widget.prototype.destroy.call( this );
              }
          });
      })( jQuery );
  </code></pre>