diff options
| author | Robert Speicher <robert@gitlab.com> | 2017-05-02 21:32:14 +0000 |
|---|---|---|
| committer | Bob Van Landuyt <bob@gitlab.com> | 2017-05-10 11:09:35 +0200 |
| commit | 39eee5babd279d0c8f46a173a47f98d2fe1a0cbc (patch) | |
| tree | a41aa5fb1cba3aa3c8e819937040b149f5bbb4a1 | |
| parent | 050d92f8177513b74d6c18d75d35a62f5fa6addd (diff) | |
| download | gitlab-ce-39eee5babd279d0c8f46a173a47f98d2fe1a0cbc.tar.gz | |
Merge branch 'fix-hamlit-xss' into 'security-9-1'
New Hamlit XSS fix, does not include extraneous changes
See merge request !2095
| -rw-r--r-- | app/views/import/base/create.js.haml | 2 | ||||
| -rw-r--r-- | app/views/projects/imports/new.html.haml | 2 | ||||
| -rw-r--r-- | app/views/projects/wikis/git_access.html.haml | 2 | ||||
| -rw-r--r-- | changelogs/unreleased/hamlit-xss-fix.yml | 4 | ||||
| -rw-r--r-- | spec/views/projects/imports/new.html.haml_spec.rb | 22 |
5 files changed, 29 insertions, 3 deletions
diff --git a/app/views/import/base/create.js.haml b/app/views/import/base/create.js.haml index 8e929538351..57e8c3ca1e1 100644 --- a/app/views/import/base/create.js.haml +++ b/app/views/import/base/create.js.haml @@ -10,4 +10,4 @@ - else :plain job = $("tr#repo_#{@repo_id}") - job.find(".import-actions").html("<i class='fa fa-exclamation-circle'></i> Error saving project: #{escape_javascript(@project.errors.full_messages.join(','))}") + job.find(".import-actions").html("<i class='fa fa-exclamation-circle'></i> Error saving project: #{escape_javascript(h(@project.errors.full_messages.join(',')))}") diff --git a/app/views/projects/imports/new.html.haml b/app/views/projects/imports/new.html.haml index 2cd8d03e30e..25a87411cac 100644 --- a/app/views/projects/imports/new.html.haml +++ b/app/views/projects/imports/new.html.haml @@ -10,7 +10,7 @@ .panel-body %pre :preserve - #{sanitize_repo_path(@project, @project.import_error)} + #{h(sanitize_repo_path(@project, @project.import_error))} = form_for @project, url: namespace_project_import_path(@project.namespace, @project), method: :post, html: { class: 'form-horizontal' } do |f| = render "shared/import_form", f: f diff --git a/app/views/projects/wikis/git_access.html.haml b/app/views/projects/wikis/git_access.html.haml index fb0efd85dcd..68862206248 100644 --- a/app/views/projects/wikis/git_access.html.haml +++ b/app/views/projects/wikis/git_access.html.haml @@ -28,7 +28,7 @@ %h3 Clone your wiki %pre.dark :preserve - git clone #{ content_tag(:span, default_url_to_repo(@project_wiki), class: 'clone')} + git clone #{ content_tag(:span, h(default_url_to_repo(@project_wiki)), class: 'clone')} cd #{h @project_wiki.path} %h3 Start Gollum and edit locally diff --git a/changelogs/unreleased/hamlit-xss-fix.yml b/changelogs/unreleased/hamlit-xss-fix.yml new file mode 100644 index 00000000000..ba4713846e9 --- /dev/null +++ b/changelogs/unreleased/hamlit-xss-fix.yml @@ -0,0 +1,4 @@ +--- +title: Fix for XSS in project import view caused by Hamlit filter usage. +merge_request: +author: diff --git a/spec/views/projects/imports/new.html.haml_spec.rb b/spec/views/projects/imports/new.html.haml_spec.rb new file mode 100644 index 00000000000..9b293065797 --- /dev/null +++ b/spec/views/projects/imports/new.html.haml_spec.rb @@ -0,0 +1,22 @@ +require "spec_helper" + +describe "projects/imports/new.html.haml" do + let(:user) { create(:user) } + + context 'when import fails' do + let(:project) { create(:project_empty_repo, import_status: :failed, import_error: '<a href="http://googl.com">Foo</a>', import_type: :gitlab_project, import_source: '/var/opt/gitlab/gitlab-rails/shared/tmp/project_exports/uploads/t.tar.gz', import_url: nil) } + + before do + sign_in(user) + project.team << [user, :master] + end + + it "escapes HTML in import errors" do + assign(:project, project) + + render + + expect(rendered).not_to have_link('Foo', href: "http://googl.com") + end + end +end |