Merge remote-tracking branch 'dev/15-8-stable' into 15-8-stable

1 files changed, 52 insertions, 1 deletions

diff --git a/spec/models/concerns/sanitizable_spec.rb b/spec/models/concerns/sanitizable_spec.rb
index 4a1d463d666..be7169f8dca 100644
--- a/spec/models/concerns/sanitizable_spec.rb
+++ b/spec/models/concerns/sanitizable_spec.rb
@@ -75,7 +75,58 @@ RSpec.describe Sanitizable do
 
         it 'is not valid', :aggregate_failures do
           expect(record).not_to be_valid
-          expect(record.errors.full_messages).to include('Name cannot contain escaped HTML entities')
+          expect(record.errors.full_messages).to contain_exactly(
+            'Name cannot contain escaped HTML entities',
+            'Description cannot contain escaped HTML entities'
+          )
+        end
+      end
+
+      context 'when input contains double-escaped data' do
+        let_it_be(:input) do
+          '%2526lt%253Bscript%2526gt%253Balert%25281%2529%2526lt%253B%252Fscript%2526gt%253B'
+        end
+
+        it_behaves_like 'noop'
+
+        it 'is not valid', :aggregate_failures do
+          expect(record).not_to be_valid
+          expect(record.errors.full_messages).to contain_exactly(
+            'Name cannot contain escaped components',
+            'Description cannot contain escaped components'
+          )
+        end
+      end
+
+      context 'when input contains a path traversal attempt' do
+        let_it_be(:input) { 'main../../../../../../api/v4/projects/1/import_project_members/2' }
+
+        it_behaves_like 'noop'
+
+        it 'is not valid', :aggregate_failures do
+          expect(record).not_to be_valid
+          expect(record.errors.full_messages).to contain_exactly(
+            'Name cannot contain a path traversal component',
+            'Description cannot contain a path traversal component'
+          )
+        end
+      end
+
+      context 'when input contains both path traversal attempt and pre-escaped entities' do
+        let_it_be(:input) do
+          'main../../../../../../api/v4/projects/1/import_project_members/2<script>alert(1)</script>'
+        end
+
+        it_behaves_like 'noop'
+
+        it 'is not valid', :aggregate_failures do
+          expect(record).not_to be_valid
+          expect(record.errors.full_messages).to contain_exactly(
+            'Name cannot contain a path traversal component',
+            'Name cannot contain escaped HTML entities',
+            'Description cannot contain a path traversal component',
+            'Description cannot contain escaped HTML entities'
+          )
         end
       end
     end