diff options
| author | Robert Speicher <robert@gitlab.com> | 2016-12-02 08:48:32 +0000 |
|---|---|---|
| committer | Alejandro RodrÃguez <alejorro70@gmail.com> | 2016-12-08 21:38:35 -0300 |
| commit | edf7dbfacd5a6b884ae1af72204e3718e89f3c35 (patch) | |
| tree | d1c4884a635a0fe7cef2cef1b3b04cc375ab8570 /app/helpers/diff_helper.rb | |
| parent | 6e1b52b8b9b83cb774a5f2f52d4b4355590f14f7 (diff) | |
| download | gitlab-ce-edf7dbfacd5a6b884ae1af72204e3718e89f3c35.tar.gz | |
Merge branch 'html-safe-diff-line-content' into 'security'
Don't accidentally mark unsafe diff lines as HTML safe
Fixes potential XSS issue when a legacy diff note is created on a merge
request whose diff contained HTML
See https://gitlab.com/gitlab-org/gitlab-ce/issues/25249
See merge request !2040
Diffstat (limited to 'app/helpers/diff_helper.rb')
| -rw-r--r-- | app/helpers/diff_helper.rb | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/app/helpers/diff_helper.rb b/app/helpers/diff_helper.rb index f489f9aa0d6..c35d6611ab0 100644 --- a/app/helpers/diff_helper.rb +++ b/app/helpers/diff_helper.rb @@ -55,7 +55,9 @@ module DiffHelper if line.blank? " ".html_safe else - line.sub(/^[\-+ ]/, '').html_safe + # We can't use `sub` because the HTML-safeness of `line` will not survive. + line[0] = '' if line.start_with?('+', '-', ' ') + line end end |