diff options
| author | Robert Speicher <robert@gitlab.com> | 2016-09-28 15:02:12 +0000 |
|---|---|---|
| committer | Robert Speicher <robert@gitlab.com> | 2016-09-28 15:02:12 +0000 |
| commit | 08bab4bbcd44ef7c5ff294d272a8ceb8571b4da7 (patch) | |
| tree | c80ea45643cc4e84cb1cc97bea069201e469cc8f /app | |
| parent | a4cddd81f1b4bd56ca99b49ce947a5e381322125 (diff) | |
| parent | 528b988aea44cc1016ee5a3c09ce0d383114e395 (diff) | |
| download | gitlab-ce-08bab4bbcd44ef7c5ff294d272a8ceb8571b4da7.tar.gz | |
Merge branch 'fix/escape-builds-commands-in-ci-linter' into 'security'
Escape HTML nodes in builds commands in ci linter
This MR removes call to `simple_format` that behaves like `String#html_safe`, thus it passes unescaped HTML tags to the view.
Closes #22541
See merge request !2001
Diffstat (limited to 'app')
| -rw-r--r-- | app/views/ci/lints/_create.html.haml | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/app/views/ci/lints/_create.html.haml b/app/views/ci/lints/_create.html.haml index f7875e68b7e..1545c00af45 100644 --- a/app/views/ci/lints/_create.html.haml +++ b/app/views/ci/lints/_create.html.haml @@ -16,8 +16,7 @@ %tr %td #{stage.capitalize} Job - #{build[:name]} %td - %pre - = simple_format build[:commands] + %pre= build[:commands] %br %b Tag list: |