Add latest changes from gitlab-org/security/gitlab@14-9-stable-ee

2 files changed, 94 insertions, 0 deletions

diff --git a/spec/features/projects/blobs/blob_show_spec.rb b/spec/features/projects/blobs/blob_show_spec.rb
index 05fd72a8932..76baad63cc2 100644
--- a/spec/features/projects/blobs/blob_show_spec.rb
+++ b/spec/features/projects/blobs/blob_show_spec.rb
@@ -948,6 +948,53 @@ RSpec.describe 'File blob', :js do
           end
         end
       end
+
+      context 'openapi.yml' do
+        before do
+          file_name = 'openapi.yml'
+
+          create_file(file_name, '
+              swagger: \'2.0\'
+              info:
+                title: Classic API Resource Documentation
+                description: |
+                        <div class="foo-bar" style="background-color: red;" data-foo-bar="baz">
+                          <h1>Swagger API documentation</h1>
+                        </div>
+                version: production
+              basePath: /JSSResource/
+              produces:
+                - application/xml
+                - application/json
+              consumes:
+                - application/xml
+                - application/json
+              security:
+                - basicAuth: []
+              paths:
+                /accounts:
+                  get:
+                    responses:
+                      \'200\':
+                        description: No response was specified
+                    tags:
+                      - accounts
+                    operationId: findAccounts
+                    summary: Finds all accounts
+            ')
+          visit_blob(file_name, useUnsafeMarkdown: '1')
+          click_button('Display rendered file')
+
+          wait_for_requests
+        end
+
+        it 'removes `style`, `class`, and `data-*`` attributes from HTML' do
+          expect(page).to have_css('h1', text: 'Swagger API documentation')
+          expect(page).not_to have_css('.foo-bar')
+          expect(page).not_to have_css('[style="background-color: red;"]')
+          expect(page).not_to have_css('[data-foo-bar="baz"]')
+        end
+      end
     end
 
     context 'realtime pipelines' do
diff --git a/spec/features/refactor_blob_viewer_disabled/projects/blobs/blob_show_spec.rb b/spec/features/refactor_blob_viewer_disabled/projects/blobs/blob_show_spec.rb
index 659014c922b..5574b4da383 100644
--- a/spec/features/refactor_blob_viewer_disabled/projects/blobs/blob_show_spec.rb
+++ b/spec/features/refactor_blob_viewer_disabled/projects/blobs/blob_show_spec.rb
@@ -1050,6 +1050,53 @@ RSpec.describe 'File blob', :js do
         end
       end
     end
+
+    context 'openapi.yml' do
+      before do
+        file_name = 'openapi.yml'
+
+        create_file(file_name, '
+            swagger: \'2.0\'
+            info:
+              title: Classic API Resource Documentation
+              description: |
+                      <div class="foo-bar" style="background-color: red;" data-foo-bar="baz">
+                        <h1>Swagger API documentation</h1>
+                      </div>
+              version: production
+            basePath: /JSSResource/
+            produces:
+              - application/xml
+              - application/json
+            consumes:
+              - application/xml
+              - application/json
+            security:
+              - basicAuth: []
+            paths:
+              /accounts:
+                get:
+                  responses:
+                    \'200\':
+                      description: No response was specified
+                  tags:
+                    - accounts
+                  operationId: findAccounts
+                  summary: Finds all accounts
+          ')
+        visit_blob(file_name, useUnsafeMarkdown: '1')
+        click_button('Display rendered file')
+
+        wait_for_requests
+      end
+
+      it 'removes `style`, `class`, and `data-*`` attributes from HTML' do
+        expect(page).to have_css('h1', text: 'Swagger API documentation')
+        expect(page).not_to have_css('.foo-bar')
+        expect(page).not_to have_css('[style="background-color: red;"]')
+        expect(page).not_to have_css('[data-foo-bar="baz"]')
+      end
+    end
   end
 
   context 'realtime pipelines' do