diff options
author | Jacob Schatz <jschatz@gitlab.com> | 2017-12-15 23:29:53 +0300 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2018-01-17 04:04:38 +0300 |
commit | 6846b70dd499f5aeee6936b3f9604fe42cafe87a (patch) | |
tree | b224025720e84fe201c0e369f0e4f0007053c6ee /spec/features/issues/issue_sidebar_spec.rb | |
parent | 72a57525a87b694799cd6406e8e8f117a902a890 (diff) |
Merge branch 'label-xss-10-3' into 'security-10-3'
[10.3] Fix XSS in issue label dropdown
See merge request gitlab/gitlabhq!2253
(cherry picked from commit 363ffabcebd7bb0d1a2d59ca1a75e4eadb4a4360)
ea1fb0ea Fix XSS in issue label dropdown
Diffstat (limited to 'spec/features/issues/issue_sidebar_spec.rb')
-rw-r--r-- | spec/features/issues/issue_sidebar_spec.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/spec/features/issues/issue_sidebar_spec.rb b/spec/features/issues/issue_sidebar_spec.rb index a5c9d0bde5d..64b4f9e7e67 100644 --- a/spec/features/issues/issue_sidebar_spec.rb +++ b/spec/features/issues/issue_sidebar_spec.rb @@ -8,6 +8,7 @@ feature 'Issue Sidebar' do let(:issue) { create(:issue, project: project) } let!(:user) { create(:user)} let!(:label) { create(:label, project: project, title: 'bug') } + let!(:xss_label) { create(:label, project: project, title: '<script>alert("xss");</script>') } before do sign_in(user) @@ -99,6 +100,14 @@ feature 'Issue Sidebar' do restore_window_size open_issue_sidebar end + + it 'escapes XSS when viewing issue labels' do + page.within('.block.labels') do + find('.edit-link').click + + expect(page).to have_content '<script>alert("xss");</script>' + end + end end context 'editing issue labels', :js do |