Add latest changes from gitlab-org/gitlab@master

2 files changed, 10 insertions, 2 deletions

diff --git a/app/assets/javascripts/issue_show/stores/index.js b/app/assets/javascripts/issue_show/stores/index.js
index 0cd094243b9..c6f7e892f9b 100644
--- a/app/assets/javascripts/issue_show/stores/index.js
+++ b/app/assets/javascripts/issue_show/stores/index.js
@@ -1,3 +1,4 @@
+import { sanitize } from 'dompurify';
 import { convertObjectPropsToCamelCase } from '~/lib/utils/common_utils';
 import updateDescription from '../utils/update_description';
 
@@ -27,8 +28,8 @@ export default class Store {
     const details =
       descriptionSection != null && descriptionSection.getElementsByTagName('details');
 
-    this.state.descriptionHtml = updateDescription(data.description, details);
-    this.state.titleHtml = data.title;
+    this.state.descriptionHtml = updateDescription(sanitize(data.description), details);
+    this.state.titleHtml = sanitize(data.title);
     this.state.lock_version = data.lock_version;
   }
 
diff --git a/app/assets/javascripts/issue_show/utils/parse_data.js b/app/assets/javascripts/issue_show/utils/parse_data.js
index 52747ceab80..a62a5167961 100644
--- a/app/assets/javascripts/issue_show/utils/parse_data.js
+++ b/app/assets/javascripts/issue_show/utils/parse_data.js
@@ -1,7 +1,12 @@
 import { sanitize } from 'dompurify';
 
+// We currently load + parse the data from the issue app and related merge request
+let cachedParsedData;
+
 export const parseIssuableData = () => {
   try {
+    if (cachedParsedData) return cachedParsedData;
+
     const initialDataEl = document.getElementById('js-issuable-app-initial-data');
 
     const parsedData = JSON.parse(initialDataEl.textContent.replace(/"/g, '"'));
@@ -9,6 +14,8 @@ export const parseIssuableData = () => {
     parsedData.initialTitleHtml = sanitize(parsedData.initialTitleHtml);
     parsedData.initialDescriptionHtml = sanitize(parsedData.initialDescriptionHtml);
 
+    cachedParsedData = parsedData;
+
     return parsedData;
   } catch (e) {
     console.error(e); // eslint-disable-line no-console