diff options
author | Douwe Maan <douwe@gitlab.com> | 2017-09-08 09:45:20 +0300 |
---|---|---|
committer | Jarka Kadlecova <jarka@gitlab.com> | 2017-09-08 11:07:06 +0300 |
commit | d1002d1e03be6ceedde6dc152b2d02bc816e47d1 (patch) | |
tree | aa3a4fd5ebb2bc93fcad8bf6be696bb84a2afdf7 /spec/helpers | |
parent | b39d0c318921bae2e3a11df9ee6828291dad9864 (diff) |
Merge branch 'rs-pick-security-into-master' into 'master'
Update master with 9.5.4 security patches
See merge request !14131
Diffstat (limited to 'spec/helpers')
-rw-r--r-- | spec/helpers/commits_helper_spec.rb | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/spec/helpers/commits_helper_spec.rb b/spec/helpers/commits_helper_spec.rb index 7179185285c..4b6c7c33e5b 100644 --- a/spec/helpers/commits_helper_spec.rb +++ b/spec/helpers/commits_helper_spec.rb @@ -12,6 +12,17 @@ describe CommitsHelper do expect(helper.commit_author_link(commit)) .not_to include('onmouseover="alert(1)"') end + + it 'escapes the author name' do + user = build_stubbed(:user, name: 'Foo <script>alert("XSS")</script>') + + commit = double(author: user, author_name: '', author_email: '') + + expect(helper.commit_author_link(commit)) + .to include('Foo <script>') + expect(helper.commit_author_link(commit, avatar: true)) + .to include('commit-author-name', 'Foo <script>') + end end describe 'commit_committer_link' do @@ -25,6 +36,17 @@ describe CommitsHelper do expect(helper.commit_committer_link(commit)) .not_to include('onmouseover="alert(1)"') end + + it 'escapes the commiter name' do + user = build_stubbed(:user, name: 'Foo <script>alert("XSS")</script>') + + commit = double(committer: user, committer_name: '', committer_email: '') + + expect(helper.commit_committer_link(commit)) + .to include('Foo <script>') + expect(helper.commit_committer_link(commit, avatar: true)) + .to include('commit-committer-name', 'Foo <script>') + end end describe '#view_on_environment_button' do |