diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-08-26 07:42:24 +0000 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-08-26 07:42:24 +0000 |
commit | 1a8e7e629e3fe7698c67f4fe8e8b7f86474ac956 (patch) | |
tree | 7cbba831e8b3a056d2a8ce7f27f988705f8f7b17 /spec | |
parent | 65695cb7817be01f28a8ed9798aa3e773488b699 (diff) | |
parent | 5f2b04a609d5a90c3a483e58c963f5041ce3ab8f (diff) | |
download | gitlab-ce-1a8e7e629e3fe7698c67f4fe8e8b7f86474ac956.tar.gz |
Merge branch 'security-fix-html-injection-for-label-description-ce-12-0' into '12-0-stable'
Fix HTML injection for label description
See merge request gitlab/gitlabhq!3256
Diffstat (limited to 'spec')
-rw-r--r-- | spec/helpers/labels_helper_spec.rb | 10 | ||||
-rw-r--r-- | spec/models/label_spec.rb | 7 |
2 files changed, 17 insertions, 0 deletions
diff --git a/spec/helpers/labels_helper_spec.rb b/spec/helpers/labels_helper_spec.rb index 314305d7a8e..5892113c4d8 100644 --- a/spec/helpers/labels_helper_spec.rb +++ b/spec/helpers/labels_helper_spec.rb @@ -296,4 +296,14 @@ describe LabelsHelper do it { is_expected.to eq('Subscribe at group level') } end end + + describe '#label_tooltip_title' do + let(:html) { '<img src="example.png">This is an image</img>' } + let(:label_with_html_content) { create(:label, title: 'test', description: html) } + + it 'removes HTML' do + tooltip = label_tooltip_title(label_with_html_content) + expect(tooltip).to eq('This is an image') + end + end end diff --git a/spec/models/label_spec.rb b/spec/models/label_spec.rb index 5174c590a10..c182e693ca7 100644 --- a/spec/models/label_spec.rb +++ b/spec/models/label_spec.rb @@ -84,6 +84,13 @@ describe Label do end end + describe '#description' do + it 'sanitizes description' do + label = described_class.new(description: '<b>foo & bar?</b>') + expect(label.description).to eq('foo & bar?') + end + end + describe 'priorization' do subject(:label) { create(:label) } |