From dd944bf14f4a0fd555db32d5833325fa459d9565 Mon Sep 17 00:00:00 2001 From: Robert Speicher Date: Mon, 13 Feb 2017 22:42:46 +0000 Subject: Merge branch 'svg-xss-fix' into 'security' Fix for XSS vulnerability in SVG attachments See https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2059 --- app/uploaders/file_uploader.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'app/uploaders/file_uploader.rb') diff --git a/app/uploaders/file_uploader.rb b/app/uploaders/file_uploader.rb index 47bef7cd1e4..23b7318827c 100644 --- a/app/uploaders/file_uploader.rb +++ b/app/uploaders/file_uploader.rb @@ -36,7 +36,7 @@ class FileUploader < GitlabUploader escaped_filename = filename.gsub("]", "\\]") markdown = "[#{escaped_filename}](#{self.secure_url})" - markdown.prepend("!") if image_or_video? + markdown.prepend("!") if image_or_video? || dangerous? { alt: filename, -- cgit v1.2.1