summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorYorick Peterse <yorickpeterse@gmail.com>2019-01-24 16:53:00 +0000
committerYorick Peterse <yorickpeterse@gmail.com>2019-01-24 16:53:48 +0000
commit304a2529db8963b06e16ea9df101ce0c07de702a (patch)
treef3185b11c3445e02e2a5b2bffeed1e1bb4ce52c1
parent52a4c0cb3f3fca755b0d46b794558073629f3bf0 (diff)
downloadgitlab-ce-304a2529db8963b06e16ea9df101ce0c07de702a.tar.gz
Merge branch '11-7-security-stored-xss-via-katex' into 'security-11-7'
[11.7] Resolve "[Security] Stored XSS via KaTeX" See merge request gitlab/gitlabhq!2820 (cherry picked from commit 53d5ce14f5b08a9733b8041b768ace2d1ec04d47) 63d8d0de 11.7 backport of fix for XSS in KaTex Links 699d42e4 Merge branch 'security-11-7' of https://dev.gitlab.org/gitlab/gitlabhq into...
-rw-r--r--changelogs/unreleased/11-7-security-stored-xss-via-katex.yml5
-rw-r--r--package.json2
-rw-r--r--spec/features/markdown/math_spec.rb22
-rw-r--r--yarn.lock17
4 files changed, 31 insertions, 15 deletions
diff --git a/changelogs/unreleased/11-7-security-stored-xss-via-katex.yml b/changelogs/unreleased/11-7-security-stored-xss-via-katex.yml
new file mode 100644
index 00000000000..a71ae1123f2
--- /dev/null
+++ b/changelogs/unreleased/11-7-security-stored-xss-via-katex.yml
@@ -0,0 +1,5 @@
+---
+title: Fixed XSS content in KaTex links
+merge_request:
+author:
+type: security
diff --git a/package.json b/package.json
index ff1140128f8..3d0a130b3f1 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
"js-cookie": "^2.1.3",
"jszip": "^3.1.3",
"jszip-utils": "^0.0.2",
- "katex": "^0.9.0",
+ "katex": "^0.10.0",
"marked": "^0.3.12",
"mermaid": "^8.0.0-rc.8",
"monaco-editor": "^0.14.3",
diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb
index 6a23d6b78ab..53abb5e3722 100644
--- a/spec/features/markdown/math_spec.rb
+++ b/spec/features/markdown/math_spec.rb
@@ -1,6 +1,8 @@
require 'spec_helper'
describe 'Math rendering', :js do
+ let!(:project) { create(:project, :public) }
+
it 'renders inline and display math correctly' do
description = <<~MATH
This math is inline $`a^2+b^2=c^2`$.
@@ -11,12 +13,26 @@ describe 'Math rendering', :js do
```
MATH
- project = create(:project, :public)
issue = create(:issue, project: project, description: description)
visit project_issue_path(project, issue)
- expect(page).to have_selector('.katex .mord.mathit', text: 'b')
- expect(page).to have_selector('.katex-display .mord.mathit', text: 'b')
+ expect(page).to have_selector('.katex .mord.mathdefault', text: 'b')
+ expect(page).to have_selector('.katex-display .mord.mathdefault', text: 'b')
+ end
+
+ it 'only renders non XSS links' do
+ description = <<~MATH
+ This link is valid $`\\href{javascript:alert('xss');}{xss}`$.
+
+ This link is valid $`\\href{https://gitlab.com}{Gitlab}`$.
+ MATH
+
+ issue = create(:issue, project: project, description: description)
+
+ visit project_issue_path(project, issue)
+
+ expect(page).to have_selector('.katex-error', text: "\href{javascript:alert('xss');}{xss}")
+ expect(page).to have_selector('.katex-html a', text: 'Gitlab')
end
end
diff --git a/yarn.lock b/yarn.lock
index fb1854265b5..95c87351018 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2279,7 +2279,7 @@ combined-stream@^1.0.6, combined-stream@~1.0.6:
dependencies:
delayed-stream "~1.0.0"
-commander@2, commander@^2.10.0, commander@^2.18.0, commander@^2.19.0:
+commander@2, commander@^2.10.0, commander@^2.16.0, commander@^2.18.0, commander@^2.19.0:
version "2.19.0"
resolved "https://registry.yarnpkg.com/commander/-/commander-2.19.0.tgz#f6198aa84e5b83c46054b94ddedbfed5ee9ff12a"
integrity sha512-6tvAOO+D6OENvRAh524Dh9jcfKTYDQAqvqezbCW82xj5X0pSrcpxtvRKHLG0yBY6SD7PSDrJaj+0AiOcKVd1Xg==
@@ -6250,12 +6250,12 @@ karma@^3.0.0:
tmp "0.0.33"
useragent "2.2.1"
-katex@^0.9.0:
- version "0.9.0"
- resolved "https://registry.yarnpkg.com/katex/-/katex-0.9.0.tgz#26a7d082c21d53725422d2d71da9b2d8455fbd4a"
- integrity sha512-lp3x90LT1tDZBW2tjLheJ98wmRMRjUHwk4QpaswT9bhqoQZ+XA4cPcjcQBxgOQNwaOSt6ZeL/a6GKQ1of3LFxQ==
+katex@^0.10.0:
+ version "0.10.0"
+ resolved "https://registry.yarnpkg.com/katex/-/katex-0.10.0.tgz#da562e5d0d5cc3aa602e27af8a9b8710bfbce765"
+ integrity sha512-/WRvx+L1eVBrLwX7QzKU1dQuaGnE7E8hDvx3VWfZh9HbMiCfsKWJNnYZ0S8ZMDAfAyDSofdyXIrH/hujF1fYXg==
dependencies:
- match-at "^0.1.1"
+ commander "^2.16.0"
keyv@3.0.0:
version "3.0.0"
@@ -6578,11 +6578,6 @@ marked@^0.3.12:
resolved "https://registry.yarnpkg.com/marked/-/marked-0.3.12.tgz#7cf25ff2252632f3fe2406bde258e94eee927519"
integrity sha512-k4NaW+vS7ytQn6MgJn3fYpQt20/mOgYM5Ft9BYMfQJDz2QT6yEeS9XJ8k2Nw8JTeWK/znPPW2n3UJGzyYEiMoA==
-match-at@^0.1.1:
- version "0.1.1"
- resolved "https://registry.yarnpkg.com/match-at/-/match-at-0.1.1.tgz#25d040d291777704d5e6556bbb79230ec2de0540"
- integrity sha512-h4Yd392z9mST+dzc+yjuybOGFNOZjmXIPKWjxBd1Bb23r4SmDOsk2NYCU2BMUBGbSpZqwVsZYNq26QS3xfaT3Q==
-
math-random@^1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/math-random/-/math-random-1.0.1.tgz#8b3aac588b8a66e4975e3cdea67f7bb329601fac"