diff options
author | Robert Speicher <robert@gitlab.com> | 2016-05-09 02:53:49 +0300 |
---|---|---|
committer | Robert Speicher <robert@gitlab.com> | 2016-05-09 02:53:49 +0300 |
commit | 4bc4f06512620271a8d454b966e7f5c288a68829 (patch) | |
tree | ebaa412a7a403c17f2af0254a5d2253508cdb398 | |
parent | 4a47470febe34bf67e84a2904422626caa64224e (diff) | |
parent | adf9a51899b02f7adc678dca7909201500f05026 (diff) |
Merge branch 'escape-commit-titles' into 'master'
Escape HTML in commit titles in system note messages
Closes #17348
See merge request !4084
-rw-r--r-- | CHANGELOG | 1 | ||||
-rw-r--r-- | app/services/system_note_service.rb | 6 | ||||
-rw-r--r-- | spec/services/system_note_service_spec.rb | 9 |
3 files changed, 15 insertions, 1 deletions
diff --git a/CHANGELOG b/CHANGELOG index f2d4f2f76b6..e85d3c88b28 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date. v 8.8.0 (unreleased) - Assign labels and milestone to target project when moving issue. !3934 (Long Nguyen) - Project#open_branches has been cleaned up and no longer loads entire records into memory. + - Escape HTML in commit titles in system note messages - Log to application.log when an admin starts and stops impersonating a user - Updated gitlab_git to 10.1.0 - GitAccess#protected_tag? no longer loads all tags just to check if a single one exists diff --git a/app/services/system_note_service.rb b/app/services/system_note_service.rb index 82a0e2fd1f5..4bdb1b0c074 100644 --- a/app/services/system_note_service.rb +++ b/app/services/system_note_service.rb @@ -351,7 +351,7 @@ class SystemNoteService # Returns an Array of Strings def self.new_commit_summary(new_commits) new_commits.collect do |commit| - "* #{commit.short_id} - #{commit.title}" + "* #{commit.short_id} - #{escape_html(commit.title)}" end end @@ -433,4 +433,8 @@ class SystemNoteService body = "Moved #{direction} #{cross_reference}" create_note(noteable: noteable, project: project, author: author, note: body) end + + def self.escape_html(text) + Rack::Utils.escape_html(text) + end end diff --git a/spec/services/system_note_service_spec.rb b/spec/services/system_note_service_spec.rb index 240eae10052..5fbf2ae5247 100644 --- a/spec/services/system_note_service_spec.rb +++ b/spec/services/system_note_service_spec.rb @@ -506,6 +506,15 @@ describe SystemNoteService, services: true do end end + describe '.new_commit_summary' do + it 'escapes HTML titles' do + commit = double(title: '<pre>This is a test</pre>', short_id: '12345678') + escaped = '* 12345678 - <pre>This is a test</pre>' + + expect(described_class.new_commit_summary([commit])).to eq([escaped]) + end + end + include JiraServiceHelper describe 'JIRA integration' do |