diff options
author | Douwe Maan <douwe@gitlab.com> | 2017-09-04 10:28:30 +0000 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2017-09-07 20:22:16 -0400 |
commit | 4acab552be05e2ee1ccb6ba1997b770dd89c42bd (patch) | |
tree | 5fb88b049f0dbdede06361b941291a7e93a19639 /app/helpers/commits_helper.rb | |
parent | 941a2d27373a99cb96561e7f41ac6ae8351dbb96 (diff) | |
download | gitlab-ce-4acab552be05e2ee1ccb6ba1997b770dd89c42bd.tar.gz |
Merge branch 'fix-escape-commit-block' into 'security-9-5'
[9.5] Prevent a persistent XSS in the commit author block
See merge request gitlab/gitlabhq!2180
Diffstat (limited to 'app/helpers/commits_helper.rb')
-rw-r--r-- | app/helpers/commits_helper.rb | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/app/helpers/commits_helper.rb b/app/helpers/commits_helper.rb index 9651f9733f9..08fb9db6c0f 100644 --- a/app/helpers/commits_helper.rb +++ b/app/helpers/commits_helper.rb @@ -137,7 +137,7 @@ module CommitsHelper text = if options[:avatar] - %Q{<span class="commit-#{options[:source]}-name">#{person_name}</span>} + content_tag(:span, person_name, class: "commit-#{options[:source]}-name") else person_name end @@ -148,9 +148,9 @@ module CommitsHelper } if user.nil? - mail_to(source_email, text.html_safe, options) + mail_to(source_email, text, options) else - link_to(text.html_safe, user_path(user), options) + link_to(text, user_path(user), options) end end |