Merge branch 'rs-issue-36104' into 'security-9-5'

[9.5] Disallow the `name` attribute on all user-provided markup

See merge request gitlab/gitlabhq!2166

2 files changed, 12 insertions, 2 deletions

diff --git a/spec/features/copy_as_gfm_spec.rb b/spec/features/copy_as_gfm_spec.rb
index 3e6a27eafd8..dfeba722ac6 100644
--- a/spec/features/copy_as_gfm_spec.rb
+++ b/spec/features/copy_as_gfm_spec.rb
@@ -288,8 +288,6 @@ describe 'Copy as GFM', js: true do
         'SanitizationFilter',
 
         <<-GFM.strip_heredoc
-        <a name="named-anchor"></a>
-
         <sub>sub</sub>
 
         <dl>
diff --git a/spec/lib/banzai/filter/sanitization_filter_spec.rb b/spec/lib/banzai/filter/sanitization_filter_spec.rb
index 659b4460fc3..01ceb21dfaa 100644
--- a/spec/lib/banzai/filter/sanitization_filter_spec.rb
+++ b/spec/lib/banzai/filter/sanitization_filter_spec.rb
@@ -101,6 +101,18 @@ describe Banzai::Filter::SanitizationFilter do
       expect(filter(act).to_html).to eq exp
     end
 
+    it 'disallows the `name` attribute globally' do
+      html = <<~HTML
+        <img name="getElementById" src="">
+        <span name="foo" class="bar">Hi</span>
+      HTML
+
+      doc = filter(html)
+
+      expect(doc.at_css('img')).not_to have_attribute('name')
+      expect(doc.at_css('span')).not_to have_attribute('name')
+    end
+
     it 'allows `summary` elements' do
       exp = act = '<summary>summary line</summary>'
       expect(filter(act).to_html).to eq exp