Add latest changes from gitlab-org/gitlab@15-0-stable-eev15.0.0-rc42

1 files changed, 11 insertions, 42 deletions

diff --git a/spec/frontend/lib/utils/url_utility_spec.js b/spec/frontend/lib/utils/url_utility_spec.js
index 7608cff4c9e..81cf4bd293b 100644
--- a/spec/frontend/lib/utils/url_utility_spec.js
+++ b/spec/frontend/lib/utils/url_utility_spec.js
@@ -1,6 +1,7 @@
 import setWindowLocation from 'helpers/set_window_location_helper';
 import { TEST_HOST } from 'helpers/test_constants';
 import * as urlUtils from '~/lib/utils/url_utility';
+import { safeUrls, unsafeUrls } from './mock_data';
 
 const shas = {
   valid: [
@@ -575,48 +576,6 @@ describe('URL utility', () => {
   });
 
   describe('isSafeUrl', () => {
-    const absoluteUrls = [
-      'http://example.org',
-      'http://example.org:8080',
-      'https://example.org',
-      'https://example.org:8080',
-      'https://192.168.1.1',
-    ];
-
-    const rootRelativeUrls = ['/relative/link'];
-
-    const relativeUrls = ['./relative/link', '../relative/link'];
-
-    const urlsWithoutHost = ['http://', 'https://', 'https:https:https:'];
-
-    /* eslint-disable no-script-url */
-    const nonHttpUrls = [
-      'javascript:',
-      'javascript:alert("XSS")',
-      'jav\tascript:alert("XSS");',
-      '   javascript:alert("XSS");',
-      'ftp://192.168.1.1',
-      'file:///',
-      'file:///etc/hosts',
-    ];
-    /* eslint-enable no-script-url */
-
-    // javascript:alert('XSS')
-    const encodedJavaScriptUrls = [
-      '&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041',
-      'javascript:alert('XSS')',
-      '&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29',
-      '\\u006A\\u0061\\u0076\\u0061\\u0073\\u0063\\u0072\\u0069\\u0070\\u0074\\u003A\\u0061\\u006C\\u0065\\u0072\\u0074\\u0028\\u0027\\u0058\\u0053\\u0053\\u0027\\u0029',
-    ];
-
-    const safeUrls = [...absoluteUrls, ...rootRelativeUrls];
-    const unsafeUrls = [
-      ...relativeUrls,
-      ...urlsWithoutHost,
-      ...nonHttpUrls,
-      ...encodedJavaScriptUrls,
-    ];
-
     describe('with URL constructor support', () => {
       it.each(safeUrls)('returns true for %s', (url) => {
         expect(urlUtils.isSafeURL(url)).toBe(true);
@@ -628,6 +587,16 @@ describe('URL utility', () => {
     });
   });
 
+  describe('sanitizeUrl', () => {
+    it.each(safeUrls)('returns the url for %s', (url) => {
+      expect(urlUtils.sanitizeUrl(url)).toBe(url);
+    });
+
+    it.each(unsafeUrls)('returns `about:blank` for %s', (url) => {
+      expect(urlUtils.sanitizeUrl(url)).toBe('about:blank');
+    });
+  });
+
   describe('getNormalizedURL', () => {
     it.each`
       url                       | base                                 | result