diff options
| author | Douwe Maan <douwe@gitlab.com> | 2016-04-19 18:16:00 +0300 |
|---|---|---|
| committer | Douwe Maan <douwe@gitlab.com> | 2016-04-19 18:16:00 +0300 |
| commit | 60942bf581d61d7e64bea9aa5be808a3fde11ace (patch) | |
| tree | 4e468acec74ffffa1b4c8ce53566ef9c46dd89c7 /app/helpers | |
| parent | 0063194ad6029915361d282392b6ab207ffd1520 (diff) | |
| parent | 17a730178def129d49e92d7a9a1b309efc67c755 (diff) | |
Merge branch 'rs-issue-15126' into 'master'
Remove persistent XSS vulnerability in `commit_person_link` helper
Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.
Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126
See merge request !1948
Diffstat (limited to 'app/helpers')
| -rw-r--r-- | app/helpers/commits_helper.rb | 2 | ||||
| -rw-r--r-- | app/helpers/projects_helper.rb | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/app/helpers/commits_helper.rb b/app/helpers/commits_helper.rb index 35ba543cef1..5394347bd15 100644 --- a/app/helpers/commits_helper.rb +++ b/app/helpers/commits_helper.rb @@ -183,7 +183,7 @@ module CommitsHelper options = { class: "commit-#{options[:source]}-link has-tooltip", - data: { 'original-title'.to_sym => sanitize(source_email) } + title: source_email } if user.nil? diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb index 7e00aacceaa..4470aa16e3f 100644 --- a/app/helpers/projects_helper.rb +++ b/app/helpers/projects_helper.rb @@ -52,7 +52,7 @@ module ProjectsHelper link_to(author_html, user_path(author), class: "author_link #{"#{opts[:mobile_classes]}" if opts[:mobile_classes]}").html_safe else title = opts[:title].sub(":name", sanitize(author.name)) - link_to(author_html, user_path(author), class: "author_link has-tooltip", data: { 'original-title'.to_sym => title, container: 'body' } ).html_safe + link_to(author_html, user_path(author), class: "author_link has-tooltip", title: title, data: { container: 'body' } ).html_safe end end |