Add latest changes from gitlab-org/gitlab@master

2 files changed, 14 insertions, 0 deletions

diff --git a/app/assets/javascripts/lib/dompurify.js b/app/assets/javascripts/lib/dompurify.js
index 47568f0ecff..4959550e273 100644
--- a/app/assets/javascripts/lib/dompurify.js
+++ b/app/assets/javascripts/lib/dompurify.js
@@ -7,6 +7,7 @@ const defaultConfig = {
   // Prevent possible XSS attacks with data-* attributes used by @rails/ujs
   // See https://gitlab.com/gitlab-org/gitlab-ui/-/issues/1421
   FORBID_ATTR: ['data-remote', 'data-url', 'data-type', 'data-method'],
+  FORBID_TAGS: ['style', 'mstyle'],
 };
 
 // Only icons urls from `gon` are allowed
diff --git a/app/assets/javascripts/lib/utils/url_utility.js b/app/assets/javascripts/lib/utils/url_utility.js
index 335cd6a16e5..ff60fd2aecb 100644
--- a/app/assets/javascripts/lib/utils/url_utility.js
+++ b/app/assets/javascripts/lib/utils/url_utility.js
@@ -420,6 +420,19 @@ export function isSafeURL(url) {
 }
 
 /**
+ * Returns the sanitized url when not safe
+ *
+ * @param {String} url
+ * @returns {String}
+ */
+export function sanitizeUrl(url) {
+  if (!isSafeURL(url)) {
+    return 'about:blank';
+  }
+  return url;
+}
+
+/**
  * Returns a normalized url
  *
  * https://gitlab.com/foo/../baz => https://gitlab.com/baz