diff options
| author | Heinrich Lee Yu <heinrich@gitlab.com> | 2019-10-26 09:06:59 +0300 |
|---|---|---|
| committer | Heinrich Lee Yu <heinrich@gitlab.com> | 2019-11-25 08:35:58 +0300 |
| commit | ddfdc0dc15afd7d62c156fecb0cdab5a3aa55b6b (patch) | |
| tree | e6a2ec5002e6c29b88d183eeab7716cf90e238b9 /lib | |
| parent | 4d477238500c347c6553d335d920bedfc5a46869 (diff) | |
Escape namespace in label references
When referencing cross-namespace labels, we append the namespace name
to the rendered label.
This MR escapes the name to prevent XSS attacks.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/banzai/filter/label_reference_filter.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/banzai/filter/label_reference_filter.rb b/lib/banzai/filter/label_reference_filter.rb index db620c65237..609ea8fb5ca 100644 --- a/lib/banzai/filter/label_reference_filter.rb +++ b/lib/banzai/filter/label_reference_filter.rb @@ -89,7 +89,7 @@ module Banzai parent_from_ref = from_ref_cached(project_path) reference = parent_from_ref.to_human_reference(parent) - label_suffix = " <i>in #{reference}</i>" if reference.present? + label_suffix = " <i>in #{ERB::Util.html_escape(reference)}</i>" if reference.present? end presenter = object.present(issuable_subject: parent) |