diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-02-01 12:04:41 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-02-01 12:04:56 +0300 |
commit | 1afa5d11a241a4f6185eb3c4cd0f2aae8201fc70 (patch) | |
tree | de23f73453d47fe15428bccab15fecc7d0c85284 | |
parent | c89dcd8f43fdcedbe97e6f68c773a8253df7ed34 (diff) |
Add latest changes from gitlab-org/security/gitlab@13-7-stable-ee
3 files changed, 19 insertions, 1 deletions
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue index dffe3cab904..99b55c0f9ee 100644 --- a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue +++ b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue @@ -1,5 +1,6 @@ <script> import { isNumber } from 'lodash'; +import { sanitize } from '~/lib/dompurify'; import ArtifactsApp from './artifacts_list_app.vue'; import MrWidgetContainer from './mr_widget_container.vue'; import MrWidgetPipeline from './mr_widget_pipeline.vue'; @@ -40,7 +41,7 @@ export default { return this.isPostMerge ? this.mr.targetBranch : this.mr.sourceBranch; }, branchLink() { - return this.isPostMerge ? this.mr.targetBranch : this.mr.sourceBranchLink; + return this.isPostMerge ? sanitize(this.mr.targetBranch) : this.mr.sourceBranchLink; }, deployments() { return this.isPostMerge ? this.mr.postMergeDeployments : this.mr.deployments; diff --git a/changelogs/unreleased/security-sanitize-target-branch.yml b/changelogs/unreleased/security-sanitize-target-branch.yml new file mode 100644 index 00000000000..9cf07fbfca4 --- /dev/null +++ b/changelogs/unreleased/security-sanitize-target-branch.yml @@ -0,0 +1,5 @@ +--- +title: Sanitize target branch on MR page +merge_request: +author: +type: security diff --git a/spec/frontend/vue_mr_widget/components/mr_widget_pipeline_container_spec.js b/spec/frontend/vue_mr_widget/components/mr_widget_pipeline_container_spec.js index d67f1adadf2..e4da729bec6 100644 --- a/spec/frontend/vue_mr_widget/components/mr_widget_pipeline_container_spec.js +++ b/spec/frontend/vue_mr_widget/components/mr_widget_pipeline_container_spec.js @@ -78,6 +78,18 @@ describe('MrWidgetPipelineContainer', () => { }); }); + it('sanitizes the targetBranch', () => { + factory({ + isPostMerge: true, + mr: { + ...mockStore, + targetBranch: 'Foo<script>alert("XSS")</script>', + }, + }); + + expect(wrapper.find(MrWidgetPipeline).props().sourceBranchLink).toBe('Foo'); + }); + it('renders deployments', () => { const expectedProps = mockStore.postMergeDeployments.map(dep => expect.objectContaining({ |