vrchat.com/home/search Switching tabs after searching (ie. from Users search to Worlds search) under the search bar lacks input sanitization, and just instantly updates the current URL by concatenating the user input to it. While not a security issue, as it can only redirect users to inside of the vrchat.com/home site, this has some annoying sideeffects that hamper the usability of the search function, or are just generally annoying. For example: If your search query contains the '%' character, you are likely to encounter an URIError: URI malformed error when switching tabs. If your query contains a '/' character, you are likely to encounter a blank search pane with absolutely no feedback. (because it accidentally navigated you to a nonexistent page) If your query contains a '?' character, it is likely that the characters following the question mark get cut off. This is likely because of a missing encodeURIComponent(input) or something. Also, by default (without even switching the search tabs) any characters following a '#' (Or the string "Tag:") up until a space are going to be ignored by the search. This is hardcoded in the client for some reason? This results in users not being able to search for tags. I don't know if this is intended behaviour or not. Also, by default if there is no '#' or "Tag:" present, there is no "minimum string length", but if one of them is present, then it requires at least 3 (non-ignored) characters. There is some funny stuff you can do with the lacking input sanitization, try entering "../../accountlink" inside the search field, and then clicking on the worlds (or events) tab. (The "../" string inside of an URL allows you to navigate backwards from the current path.)
