diff options
author | Jan Provaznik <jprovaznik@gitlab.com> | 2018-10-29 16:06:01 +0000 |
---|---|---|
committer | Jan Provaznik <jprovaznik@gitlab.com> | 2018-10-29 16:06:01 +0000 |
commit | b5ca4ea15dee21b131b336d4189a75a283c8d1f1 (patch) | |
tree | 8530c19913a7aa92b7a83a0810a57e1bd6d49312 /spec/presenters | |
parent | 107351e07a69d94cd9aa27ca3439b1d79845fdc5 (diff) | |
parent | 2f4afe45525f6536c808d46249d7557ea14de7e8 (diff) | |
download | gitlab-ce-b5ca4ea15dee21b131b336d4189a75a283c8d1f1.tar.gz |
Merge branch 'security-51527-xss-in-mr-source-branch' into 'master'
[master] Fix XSS in MR source branch name
See merge request gitlab/gitlabhq!2544
Diffstat (limited to 'spec/presenters')
-rw-r--r-- | spec/presenters/merge_request_presenter_spec.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/spec/presenters/merge_request_presenter_spec.rb b/spec/presenters/merge_request_presenter_spec.rb index a1b52d8692d..bafcddebbb7 100644 --- a/spec/presenters/merge_request_presenter_spec.rb +++ b/spec/presenters/merge_request_presenter_spec.rb @@ -403,6 +403,15 @@ describe MergeRequestPresenter do is_expected .to eq("<a href=\"/#{resource.source_project.full_path}/tree/#{resource.source_branch}\">#{resource.source_branch}</a>") end + + it 'escapes html, when source_branch does not exist' do + xss_attempt = "<img src='x' onerror=alert('bad stuff') />" + + allow(resource).to receive(:source_branch) { xss_attempt } + allow(resource).to receive(:source_branch_exists?) { false } + + is_expected.to eq(ERB::Util.html_escape(xss_attempt)) + end end describe '#rebase_path' do |