diff options
author | Timothy Andrew <tim@gitlab.com> | 2017-05-26 05:44:28 +0000 |
---|---|---|
committer | Timothy Andrew <mail@timothyandrew.net> | 2017-05-31 03:52:57 +0000 |
commit | 6a9efdc502b26337477b8ec55bbe7240b349891c (patch) | |
tree | 7f1227fe2ea6cf9e54c66c923003d42edb82b7e8 | |
parent | 7acf831645c3e6ec977a9cc3d02fdbbf7b8e485a (diff) | |
download | gitlab-ce-6a9efdc502b26337477b8ec55bbe7240b349891c.tar.gz |
Merge branch 'cherry-pick-dc2ac993' into 'security-9-2'
Escapes html content before appending it to the DOM
See merge request !2107
-rw-r--r-- | app/assets/javascripts/notes.js | 4 | ||||
-rw-r--r-- | changelogs/unreleased/32908-edit-comment.yml | 4 | ||||
-rw-r--r-- | spec/javascripts/notes_spec.js | 39 |
3 files changed, 45 insertions, 2 deletions
diff --git a/app/assets/javascripts/notes.js b/app/assets/javascripts/notes.js index 233c2e637af..8ff25c10157 100644 --- a/app/assets/javascripts/notes.js +++ b/app/assets/javascripts/notes.js @@ -1385,7 +1385,7 @@ const normalizeNewlines = function(str) { const cachedNoteBodyText = $noteBodyText.html(); // Show updated comment content temporarily - $noteBodyText.html(formContent); + $noteBodyText.html(_.escape(formContent)); $editingNote.removeClass('is-editing fade-in-full').addClass('being-posted fade-in-half'); $editingNote.find('.note-headline-meta a').html('<i class="fa fa-spinner fa-spin" aria-label="Comment is being updated" aria-hidden="true"></i>'); @@ -1398,7 +1398,7 @@ const normalizeNewlines = function(str) { }) .fail(() => { // Submission failed, revert back to original note - $noteBodyText.html(cachedNoteBodyText); + $noteBodyText.html(_.escape(cachedNoteBodyText)); $editingNote.removeClass('being-posted fade-in'); $editingNote.find('.fa.fa-spinner').remove(); diff --git a/changelogs/unreleased/32908-edit-comment.yml b/changelogs/unreleased/32908-edit-comment.yml new file mode 100644 index 00000000000..5237dceed11 --- /dev/null +++ b/changelogs/unreleased/32908-edit-comment.yml @@ -0,0 +1,4 @@ +--- +title: Escapes html content before appending it to the DOM +merge_request: +author: diff --git a/spec/javascripts/notes_spec.js b/spec/javascripts/notes_spec.js index bcee0498d64..8fb2216d94b 100644 --- a/spec/javascripts/notes_spec.js +++ b/spec/javascripts/notes_spec.js @@ -442,6 +442,45 @@ import '~/notes'; }); }); + describe('update comment with script tags', () => { + const sampleComment = '<script></script>'; + const updatedComment = '<script></script>'; + const note = { + id: 1234, + html: `<li class="note note-row-1234 timeline-entry" id="note_1234"> + <div class="note-text">${sampleComment}</div> + </li>`, + note: sampleComment, + valid: true + }; + let $form; + let $notesContainer; + + beforeEach(() => { + this.notes = new Notes('', []); + window.gon.current_username = 'root'; + window.gon.current_user_fullname = 'Administrator'; + $form = $('form.js-main-target-form'); + $notesContainer = $('ul.main-notes-list'); + $form.find('textarea.js-note-text').html(sampleComment); + }); + + it('should not render a script tag', () => { + const deferred = $.Deferred(); + spyOn($, 'ajax').and.returnValue(deferred.promise()); + $('.js-comment-button').click(); + + deferred.resolve(note); + const $noteEl = $notesContainer.find(`#note_${note.id}`); + $noteEl.find('.js-note-edit').click(); + $noteEl.find('textarea.js-note-text').html(updatedComment); + $noteEl.find('.js-comment-save-button').click(); + + const $updatedNoteEl = $notesContainer.find(`#note_${note.id}`).find('.js-task-list-container'); + expect($updatedNoteEl.find('.note-text').text().trim()).toEqual(''); + }); + }); + describe('getFormData', () => { it('should return form metadata object from form reference', () => { this.notes = new Notes('', []); |