diff options
author | Douwe Maan <douwe@gitlab.com> | 2017-09-04 13:28:30 +0300 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2017-09-08 03:22:16 +0300 |
commit | 4acab552be05e2ee1ccb6ba1997b770dd89c42bd (patch) | |
tree | 5fb88b049f0dbdede06361b941291a7e93a19639 /spec/helpers/commits_helper_spec.rb | |
parent | 941a2d27373a99cb96561e7f41ac6ae8351dbb96 (diff) |
Merge branch 'fix-escape-commit-block' into 'security-9-5'
[9.5] Prevent a persistent XSS in the commit author block
See merge request gitlab/gitlabhq!2180
Diffstat (limited to 'spec/helpers/commits_helper_spec.rb')
-rw-r--r-- | spec/helpers/commits_helper_spec.rb | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/spec/helpers/commits_helper_spec.rb b/spec/helpers/commits_helper_spec.rb index 7179185285c..4b6c7c33e5b 100644 --- a/spec/helpers/commits_helper_spec.rb +++ b/spec/helpers/commits_helper_spec.rb @@ -12,6 +12,17 @@ describe CommitsHelper do expect(helper.commit_author_link(commit)) .not_to include('onmouseover="alert(1)"') end + + it 'escapes the author name' do + user = build_stubbed(:user, name: 'Foo <script>alert("XSS")</script>') + + commit = double(author: user, author_name: '', author_email: '') + + expect(helper.commit_author_link(commit)) + .to include('Foo <script>') + expect(helper.commit_author_link(commit, avatar: true)) + .to include('commit-author-name', 'Foo <script>') + end end describe 'commit_committer_link' do @@ -25,6 +36,17 @@ describe CommitsHelper do expect(helper.commit_committer_link(commit)) .not_to include('onmouseover="alert(1)"') end + + it 'escapes the commiter name' do + user = build_stubbed(:user, name: 'Foo <script>alert("XSS")</script>') + + commit = double(committer: user, committer_name: '', committer_email: '') + + expect(helper.commit_committer_link(commit)) + .to include('Foo <script>') + expect(helper.commit_committer_link(commit, avatar: true)) + .to include('commit-committer-name', 'Foo <script>') + end end describe '#view_on_environment_button' do |