diff options
| author | Filipa Lacerda <filipa@gitlab.com> | 2018-08-09 12:05:13 +0100 |
|---|---|---|
| committer | Filipa Lacerda <filipa@gitlab.com> | 2018-08-09 18:28:05 +0100 |
| commit | 5e8f11e5fdb792f17d86cf9321537c5c56801a17 (patch) | |
| tree | 77a87f8692bd1a24cb4c76d11c7c7740ee1e466f /spec/lib/gitlab/ci/status/build/factory_spec.rb | |
| parent | 68082d352516b5367fce76453b8992f4e44d127e (diff) | |
| download | gitlab-ce-5e8f11e5fdb792f17d86cf9321537c5c56801a17.tar.gz | |
Removes <br> sent from backend on tooltips in jobs
When backend sends HTML it requires frontend to append it to the DOM causing
XSS vulnerabilities. By removing the `<br>` we avoid those vulnerabilities
Diffstat (limited to 'spec/lib/gitlab/ci/status/build/factory_spec.rb')
| -rw-r--r-- | spec/lib/gitlab/ci/status/build/factory_spec.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/spec/lib/gitlab/ci/status/build/factory_spec.rb b/spec/lib/gitlab/ci/status/build/factory_spec.rb index d53a7d468e3..8b92088902b 100644 --- a/spec/lib/gitlab/ci/status/build/factory_spec.rb +++ b/spec/lib/gitlab/ci/status/build/factory_spec.rb @@ -88,7 +88,7 @@ describe Gitlab::Ci::Status::Build::Factory do expect(status.icon).to eq 'status_failed' expect(status.favicon).to eq 'favicon_status_failed' expect(status.label).to eq 'failed' - expect(status.status_tooltip).to eq 'failed <br> (unknown failure)' + expect(status.status_tooltip).to eq 'failed - (unknown failure)' expect(status).to have_details expect(status).to have_action end |