Merge branch 'security-fix-html-injection-for-label-description-ce-12-0' into '12-0-stable'

Fix HTML injection for label description

See merge request gitlab/gitlabhq!3256

1 files changed, 7 insertions, 0 deletions

diff --git a/spec/models/label_spec.rb b/spec/models/label_spec.rb
index 5174c590a10..c182e693ca7 100644
--- a/spec/models/label_spec.rb
+++ b/spec/models/label_spec.rb
@@ -84,6 +84,13 @@ describe Label do
     end
   end
 
+  describe '#description' do
+    it 'sanitizes description' do
+      label = described_class.new(description: '<b>foo & bar?</b>')
+      expect(label.description).to eq('foo & bar?')
+    end
+  end
+
   describe 'priorization' do
     subject(:label) { create(:label) }