diff options
| author | Mark Chao <mchao@gitlab.com> | 2018-09-12 09:34:55 +0300 |
|---|---|---|
| committer | Mark Chao <mchao@gitlab.com> | 2018-09-19 04:13:33 +0300 |
| commit | 3bd607f280b70bdc7c574a4c217168adb1a88ecd (patch) | |
| tree | d94505e6ab20b12dc0a3e0a59f9072432951f668 /app/models/blob_viewer | |
| parent | 2dac058de25dc6ed03d0ed6f8b099aa17cdc1cab (diff) | |
Fix xss vulnerability sourced from package.json's homepage
Diffstat (limited to 'app/models/blob_viewer')
| -rw-r--r-- | app/models/blob_viewer/package_json.rb | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/app/models/blob_viewer/package_json.rb b/app/models/blob_viewer/package_json.rb index d12dd93ce2e..7cae60a74d6 100644 --- a/app/models/blob_viewer/package_json.rb +++ b/app/models/blob_viewer/package_json.rb @@ -33,7 +33,8 @@ module BlobViewer end def homepage - json_data['homepage'] + url = json_data['homepage'] + url if Gitlab::UrlSanitizer.valid?(url) end def npm_url |