Escape quotes in gl_dropdown values to prevent exceptions

4 files changed, 36 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e9c97a1ec66..e289a990629 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ Please view this file on the master branch, on stable branches it's out of date.
   - Add hover to trash icon in notes !7008 (blackst0ne)
   - Escape ref and path for relative links !6050 (winniehell)
   - Fixed link typo on /help/ui to Alerts section. !6915 (Sam Rose)
+  - Fix filtering of milestones with quotes in title (airatshigapov)
   - Simpler arguments passed to named_route on toggle_award_url helper method
   - Fix: Backup restore doesn't clear cache
   - API: Fix project deploy keys 400 and 500 errors when adding an existing key. !6784 (Joshua Welsh)
diff --git a/app/assets/javascripts/gl_dropdown.js b/app/assets/javascripts/gl_dropdown.js
index 53762f2965c..82bbd464332 100644
--- a/app/assets/javascripts/gl_dropdown.js
+++ b/app/assets/javascripts/gl_dropdown.js
@@ -549,6 +549,8 @@
           value = this.options.id ? this.options.id(data) : data.id;
           fieldName = this.options.fieldName;
 
+          if (value) { value = value.toString().replace(/'/g, '\\\'') };
+
           field = this.dropdown.parent().find("input[name='" + fieldName + "'][value='" + value + "']");
           if (field.length) {
             selected = true;
diff --git a/spec/features/issues/filter_by_milestone_spec.rb b/spec/features/issues/filter_by_milestone_spec.rb
index 485dc560061..88e1549a22b 100644
--- a/spec/features/issues/filter_by_milestone_spec.rb
+++ b/spec/features/issues/filter_by_milestone_spec.rb
@@ -58,6 +58,22 @@ feature 'Issue filtering by Milestone', feature: true do
     expect(page).to have_css('.issue', count: 1)
   end
 
+  context 'when milestone has single quotes in title' do
+    background do
+      milestone.update(name: "rock 'n' roll")
+    end
+
+    scenario 'filters by a specific Milestone', js: true do
+      create(:issue, project: project, milestone: milestone)
+      create(:issue, project: project)
+
+      visit_issues(project)
+      filter_by_milestone(milestone.title)
+
+      expect(page).to have_css('.issue', count: 1)
+    end
+  end
+
   def visit_issues(project)
     visit namespace_project_issues_path(project.namespace, project)
   end
diff --git a/spec/features/merge_requests/filter_by_milestone_spec.rb b/spec/features/merge_requests/filter_by_milestone_spec.rb
index d917d5950ec..f6e9230c8da 100644
--- a/spec/features/merge_requests/filter_by_milestone_spec.rb
+++ b/spec/features/merge_requests/filter_by_milestone_spec.rb
@@ -67,6 +67,23 @@ feature 'Merge Request filtering by Milestone', feature: true do
     expect(page).to have_css('.merge-request', count: 1)
   end
 
+  context 'when milestone has single quotes in title' do
+    background do
+      milestone.update(name: "rock 'n' roll")
+    end
+
+    scenario 'filters by a specific Milestone', js: true do
+      create(:merge_request, :with_diffs, source_project: project, milestone: milestone)
+      create(:merge_request, :simple, source_project: project)
+
+      visit_merge_requests(project)
+      filter_by_milestone(milestone.title)
+
+      expect(page).to have_issuable_counts(open: 1, closed: 0, all: 1)
+      expect(page).to have_css('.merge-request', count: 1)
+    end
+  end
+
   def visit_merge_requests(project)
     visit namespace_project_merge_requests_path(project.namespace, project)
   end