Add latest changes from gitlab-org/security/gitlab@14-0-stable-ee

1 files changed, 2 insertions, 1 deletions

diff --git a/app/assets/javascripts/behaviors/markdown/copy_as_gfm.js b/app/assets/javascripts/behaviors/markdown/copy_as_gfm.js
index 9a8af79210e..19ebab36481 100644
--- a/app/assets/javascripts/behaviors/markdown/copy_as_gfm.js
+++ b/app/assets/javascripts/behaviors/markdown/copy_as_gfm.js
@@ -1,4 +1,5 @@
 import $ from 'jquery';
+import { sanitize } from '~/lib/dompurify';
 import { getSelectedFragment, insertText } from '~/lib/utils/common_utils';
 
 export class CopyAsGFM {
@@ -69,7 +70,7 @@ export class CopyAsGFM {
     } else {
       // Due to the async copy call we are not able to produce gfm so we transform the cached HTML
       const div = document.createElement('div');
-      div.innerHTML = gfmHtml;
+      div.innerHTML = sanitize(gfmHtml);
       CopyAsGFM.nodeToGFM(div)
         .then((transformedGfm) => {
           CopyAsGFM.insertPastedText(e.target, text, transformedGfm);