diff options
| author | Filipa Lacerda <filipa@gitlab.com> | 2018-07-12 15:58:33 +0100 |
|---|---|---|
| committer | Filipa Lacerda <filipa@gitlab.com> | 2018-07-13 15:00:14 +0100 |
| commit | fc9f90045d930641690f75e9bae25683dc67a24e (patch) | |
| tree | 1ffe6c8139ad0a32e558b5dfca797151672cbd56 | |
| parent | cfe2121978a235d93d9bacefde37702bfa1f4848 (diff) | |
| download | gitlab-ce-fc9f90045d930641690f75e9bae25683dc67a24e.tar.gz | |
Escapes milestone title shown in flash message when promoting a milestone
| -rw-r--r-- | app/controllers/projects/milestones_controller.rb | 5 | ||||
| -rw-r--r-- | spec/controllers/projects/milestones_controller_spec.rb | 8 |
2 files changed, 11 insertions, 2 deletions
diff --git a/app/controllers/projects/milestones_controller.rb b/app/controllers/projects/milestones_controller.rb index 5e86ec93f34..17571935c1c 100644 --- a/app/controllers/projects/milestones_controller.rb +++ b/app/controllers/projects/milestones_controller.rb @@ -1,4 +1,5 @@ class Projects::MilestonesController < Projects::ApplicationController + include ActionView::Helpers::SanitizeHelper include Gitlab::Utils::StrongMemoize include MilestoneActions @@ -76,8 +77,8 @@ class Projects::MilestonesController < Projects::ApplicationController def promote promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone) - - flash[:notice] = "#{milestone.title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe + milestone_title = sanitize(milestone.title) + flash[:notice] = "#{milestone_title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe respond_to do |format| format.html do redirect_to project_milestones_path(project) diff --git a/spec/controllers/projects/milestones_controller_spec.rb b/spec/controllers/projects/milestones_controller_spec.rb index ea906cf7f32..e351e0fe07d 100644 --- a/spec/controllers/projects/milestones_controller_spec.rb +++ b/spec/controllers/projects/milestones_controller_spec.rb @@ -127,6 +127,14 @@ describe Projects::MilestonesController do expect(flash[:notice]).to eq("#{milestone.title} promoted to <a href=\"#{group_milestone_path(project.group, milestone.iid)}\"><u>group milestone</u></a>.") expect(response).to redirect_to(project_milestones_path(project)) end + + it 'renders milestone name without parsing it as HTML' do + milestone.update!(name: 'CCC<img src=x onerror=alert(document.domain)>') + + post :promote, namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid + + expect(flash[:notice]).to eq("CCC<img src=\"x\"> promoted to <a href=\"#{group_milestone_path(project.group, milestone.iid)}\"><u>group milestone</u></a>.") + end end context 'promotion fails' do |