diff options
author | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2022-06-30 18:09:59 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2022-06-30 18:09:59 +0300 |
commit | 4dc46d5b97305108c1b635baa4241a2ce04a7ed0 (patch) | |
tree | 8566723c46f2a3bc51a7bf60d10f8cd092ae8d01 /spec/frontend | |
parent | c5b70709451c5ea9ed3cb850b31d524832a4aae1 (diff) | |
parent | cb0f45a3375a51255accf6586499bdc3a1862bab (diff) |
Merge remote-tracking branch 'dev/15-0-stable' into 15-0-stable
Diffstat (limited to 'spec/frontend')
-rw-r--r-- | spec/frontend/projects/settings/access_dropdown_spec.js | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/spec/frontend/projects/settings/access_dropdown_spec.js b/spec/frontend/projects/settings/access_dropdown_spec.js index 65b01172e7e..d51360a7597 100644 --- a/spec/frontend/projects/settings/access_dropdown_spec.js +++ b/spec/frontend/projects/settings/access_dropdown_spec.js @@ -159,4 +159,21 @@ describe('AccessDropdown', () => { expect(template).not.toContain(user.name); }); }); + + describe('deployKeyRowHtml', () => { + const deployKey = { + id: 1, + title: 'title <script>alert(document.domain)</script>', + fullname: 'fullname <script>alert(document.domain)</script>', + avatar_url: '', + username: '', + }; + + it('escapes deploy key title and fullname', () => { + const template = dropdown.deployKeyRowHtml(deployKey); + + expect(template).not.toContain(deployKey.title); + expect(template).not.toContain(deployKey.fullname); + }); + }); }); |