diff options
author | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-25 12:38:19 +0000 |
---|---|---|
committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-25 12:38:33 +0000 |
commit | dfdb57496d450ac7215b1a5400c3d3b5b5c9dbc4 (patch) | |
tree | 505c740ed714350b9a4ad678a18cc3f8c479de6f /spec | |
parent | 6092f269cd62d5bd5fd515143bde8f353b64fc4f (diff) | |
download | gitlab-ce-dfdb57496d450ac7215b1a5400c3d3b5b5c9dbc4.tar.gz |
Merge branch '11-6-security-stored-xss-via-katex' into 'security-11-6'
[11.6] Resolve "[Security] Stored XSS via KaTeX"
See merge request gitlab/gitlabhq!2755
(cherry picked from commit f79ff59ee1e21a5dbff19b86c5d5af16b62ac894)
024098db 11.6 backport of fix for XSS in KaTex Links
37b798d7 Merge branch 'security-11-6' of https://dev.gitlab.org/gitlab/gitlabhq into...
Diffstat (limited to 'spec')
-rw-r--r-- | spec/features/markdown/math_spec.rb | 22 |
1 files changed, 19 insertions, 3 deletions
diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb index 6a23d6b78ab..53abb5e3722 100644 --- a/spec/features/markdown/math_spec.rb +++ b/spec/features/markdown/math_spec.rb @@ -1,6 +1,8 @@ require 'spec_helper' describe 'Math rendering', :js do + let!(:project) { create(:project, :public) } + it 'renders inline and display math correctly' do description = <<~MATH This math is inline $`a^2+b^2=c^2`$. @@ -11,12 +13,26 @@ describe 'Math rendering', :js do ``` MATH - project = create(:project, :public) issue = create(:issue, project: project, description: description) visit project_issue_path(project, issue) - expect(page).to have_selector('.katex .mord.mathit', text: 'b') - expect(page).to have_selector('.katex-display .mord.mathit', text: 'b') + expect(page).to have_selector('.katex .mord.mathdefault', text: 'b') + expect(page).to have_selector('.katex-display .mord.mathdefault', text: 'b') + end + + it 'only renders non XSS links' do + description = <<~MATH + This link is valid $`\\href{javascript:alert('xss');}{xss}`$. + + This link is valid $`\\href{https://gitlab.com}{Gitlab}`$. + MATH + + issue = create(:issue, project: project, description: description) + + visit project_issue_path(project, issue) + + expect(page).to have_selector('.katex-error', text: "\href{javascript:alert('xss');}{xss}") + expect(page).to have_selector('.katex-html a', text: 'Gitlab') end end |