diff options
author | Bob Van Landuyt <bob@gitlab.com> | 2018-09-24 17:46:51 +0300 |
---|---|---|
committer | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-09-24 17:53:32 +0300 |
commit | e5f4dbdb6cefa6b704bd518378a371f84979c6f0 (patch) | |
tree | f43f308f62d8b7b02faa22792614d9c647e7a5a7 /app | |
parent | 2ac1702119e36d0fa44188b4716523daba8fb359 (diff) |
Merge branch 'security-acet-issue-details-11-3' into 'security-11-3'
[11.3] Fix XSS on Issue details page.
See merge request gitlab/gitlabhq!2495
Diffstat (limited to 'app')
-rw-r--r-- | app/assets/javascripts/issue_show/index.js | 7 | ||||
-rw-r--r-- | app/assets/javascripts/pages/projects/issues/show.js | 3 |
2 files changed, 6 insertions, 4 deletions
diff --git a/app/assets/javascripts/issue_show/index.js b/app/assets/javascripts/issue_show/index.js index 75dfdedcf1b..d08e8ba0c4b 100644 --- a/app/assets/javascripts/issue_show/index.js +++ b/app/assets/javascripts/issue_show/index.js @@ -1,10 +1,11 @@ import Vue from 'vue'; +import sanitize from 'sanitize-html'; import issuableApp from './components/app.vue'; import '../vue_shared/vue_resource_interceptor'; -document.addEventListener('DOMContentLoaded', () => { +export default function initIssueableApp() { const initialDataEl = document.getElementById('js-issuable-app-initial-data'); - const props = JSON.parse(initialDataEl.innerHTML.replace(/"/g, '"')); + const props = JSON.parse(sanitize(initialDataEl.textContent).replace(/"/g, '"')); return new Vue({ el: document.getElementById('js-issuable-app'), @@ -17,4 +18,4 @@ document.addEventListener('DOMContentLoaded', () => { }); }, }); -}); +} diff --git a/app/assets/javascripts/pages/projects/issues/show.js b/app/assets/javascripts/pages/projects/issues/show.js index 500fbd27340..3f415391aa1 100644 --- a/app/assets/javascripts/pages/projects/issues/show.js +++ b/app/assets/javascripts/pages/projects/issues/show.js @@ -3,9 +3,10 @@ import Issue from '~/issue'; import ShortcutsIssuable from '~/shortcuts_issuable'; import ZenMode from '~/zen_mode'; import '~/notes/index'; -import '~/issue_show/index'; +import initIssueableApp from '~/issue_show'; export default function () { + initIssueableApp(); new Issue(); // eslint-disable-line no-new new ShortcutsIssuable(); // eslint-disable-line no-new new ZenMode(); // eslint-disable-line no-new |