diff options
| author | Douwe Maan <douwe@gitlab.com> | 2016-04-19 18:16:00 +0300 |
|---|---|---|
| committer | Rémy Coutable <remy@rymai.me> | 2016-04-19 18:35:32 +0300 |
| commit | 2c9cd67f78ea5cebc8fa4c57027990589bea0d2d (patch) | |
| tree | a3f91abb3461fe02049d387ffa494388934c4f16 /app/helpers/commits_helper.rb | |
| parent | 93e923fc044f4d686b72a6db882620c538727f9b (diff) | |
Merge branch 'rs-issue-15126' into 'master'
Remove persistent XSS vulnerability in `commit_person_link` helper
Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.
Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126
See merge request !1948
Signed-off-by: Rémy Coutable <remy@rymai.me>
Diffstat (limited to 'app/helpers/commits_helper.rb')
| -rw-r--r-- | app/helpers/commits_helper.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/helpers/commits_helper.rb b/app/helpers/commits_helper.rb index a09e91578b6..f45a3050cb6 100644 --- a/app/helpers/commits_helper.rb +++ b/app/helpers/commits_helper.rb @@ -183,7 +183,7 @@ module CommitsHelper options = { class: "commit-#{options[:source]}-link has_tooltip", - data: { 'original-title'.to_sym => sanitize(source_email) } + title: source_email } if user.nil? |