diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-03-31 01:42:44 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-03-31 01:43:07 +0300 |
commit | ac9a8518364e91d64cb01732bf41896b6d2912b6 (patch) | |
tree | 066754ab194088efaa216ae87e841e0ee9f1e36f /spec/features | |
parent | d455bcf1e412ab4a4abdfbe691fc40e3d4a0ce8a (diff) |
Add latest changes from gitlab-org/security/gitlab@13-10-stable-ee
Diffstat (limited to 'spec/features')
-rw-r--r-- | spec/features/merge_request/user_views_open_merge_request_spec.rb | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/spec/features/merge_request/user_views_open_merge_request_spec.rb b/spec/features/merge_request/user_views_open_merge_request_spec.rb index 9bda48a3ec5..5f99d762ecb 100644 --- a/spec/features/merge_request/user_views_open_merge_request_spec.rb +++ b/spec/features/merge_request/user_views_open_merge_request_spec.rb @@ -111,4 +111,21 @@ RSpec.describe 'User views an open merge request' do end end end + + context 'XSS source branch' do + let(:project) { create(:project, :public, :repository) } + let(:source_branch) { "'><iframe/srcdoc=''></iframe>" } + + before do + project.repository.create_branch(source_branch, "master") + + mr = create(:merge_request, source_project: project, target_project: project, source_branch: source_branch) + + visit(merge_request_path(mr)) + end + + it 'encodes branch name' do + expect(find('cite.ref-name')[:title]).to eq(source_branch) + end + end end |