diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-08-26 17:39:01 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-08-26 17:39:01 +0300 |
commit | f332982c82ad95ae2ee22242c39f78717613165f (patch) | |
tree | 25d49bea1c105fdd7cf62da42d2c91fd9146e9db /spec/helpers | |
parent | 25ed7b6ae4712518e96d4719b75dd293c57404a2 (diff) |
Add latest changes from gitlab-org/security/gitlab@15-3-stable-ee
Diffstat (limited to 'spec/helpers')
-rw-r--r-- | spec/helpers/labels_helper_spec.rb | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/spec/helpers/labels_helper_spec.rb b/spec/helpers/labels_helper_spec.rb index 5efa88a2a7d..90366d7772c 100644 --- a/spec/helpers/labels_helper_spec.rb +++ b/spec/helpers/labels_helper_spec.rb @@ -112,6 +112,14 @@ RSpec.describe LabelsHelper do end end + describe 'render_label_text' do + it 'html escapes the bg_color correctly' do + xss_payload = '"><img src=x onerror=prompt(1)>' + label_text = render_label_text('xss', bg_color: xss_payload) + expect(label_text).to include(html_escape(xss_payload)) + end + end + describe 'text_color_for_bg' do it 'uses light text on dark backgrounds' do expect(text_color_for_bg('#222E2E')).to be_color('#FFFFFF') |