diff options
author | Douwe Maan <douwe@gitlab.com> | 2018-04-03 09:57:31 +0000 |
---|---|---|
committer | James Lopez <james@jameslopez.es> | 2018-04-05 08:40:05 +0200 |
commit | 98106ec54e439455f545f3df15332a28b9b0c969 (patch) | |
tree | b7511e6b56791143e05bde0e6eb4182c51ff254c /spec/helpers | |
parent | 0498a5dd779250372aa12b4d6a0e53ef01d1b60b (diff) | |
download | gitlab-ce-98106ec54e439455f545f3df15332a28b9b0c969.tar.gz |
Merge branch '42028-xss-diffs-10-6' into 'security-10-6'
Port of "Fix XSS on commit diff view" for 10-6
See merge request gitlab/gitlabhq!2364
Diffstat (limited to 'spec/helpers')
-rw-r--r-- | spec/helpers/diff_helper_spec.rb | 30 |
1 files changed, 28 insertions, 2 deletions
diff --git a/spec/helpers/diff_helper_spec.rb b/spec/helpers/diff_helper_spec.rb index 15cbe36ae76..53c010fa0db 100644 --- a/spec/helpers/diff_helper_spec.rb +++ b/spec/helpers/diff_helper_spec.rb @@ -135,11 +135,37 @@ describe DiffHelper do it "returns strings with marked inline diffs" do marked_old_line, marked_new_line = mark_inline_diffs(old_line, new_line) - expect(marked_old_line).to eq(%q{abc <span class="idiff left right deletion">'def'</span>}) + expect(marked_old_line).to eq(%q{abc <span class="idiff left right deletion">'def'</span>}) expect(marked_old_line).to be_html_safe - expect(marked_new_line).to eq(%q{abc <span class="idiff left right addition">"def"</span>}) + expect(marked_new_line).to eq(%q{abc <span class="idiff left right addition">"def"</span>}) expect(marked_new_line).to be_html_safe end + + context 'when given HTML' do + it 'sanitizes it' do + old_line = %{test.txt} + new_line = %{<img src=x onerror=alert(document.domain)>} + + marked_old_line, marked_new_line = mark_inline_diffs(old_line, new_line) + + expect(marked_old_line).to eq(%q{<span class="idiff left right deletion">test.txt</span>}) + expect(marked_old_line).to be_html_safe + expect(marked_new_line).to eq(%q{<span class="idiff left right addition"><img src=x onerror=alert(document.domain)></span>}) + expect(marked_new_line).to be_html_safe + end + + it 'sanitizes the entire line, not just the changes' do + old_line = %{<img src=x onerror=alert(document.domain)>} + new_line = %{<img src=y onerror=alert(document.domain)>} + + marked_old_line, marked_new_line = mark_inline_diffs(old_line, new_line) + + expect(marked_old_line).to eq(%q{<img src=<span class="idiff left right deletion">x</span> onerror=alert(document.domain)>}) + expect(marked_old_line).to be_html_safe + expect(marked_new_line).to eq(%q{<img src=<span class="idiff left right addition">y</span> onerror=alert(document.domain)>}) + expect(marked_new_line).to be_html_safe + end + end end describe '#parallel_diff_discussions' do |