diff options
author | Robert Speicher <rspeicher@gmail.com> | 2016-04-18 00:48:51 +0300 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2016-04-18 01:42:49 +0300 |
commit | 7cc239528ea7f4905e6d773771006ec661d628d6 (patch) | |
tree | 8b718249cae653d938b00c36213c2d4943cf29ec /spec/helpers | |
parent | 1c93b33587a5e0a0596b43772ee9e709e9962368 (diff) |
Remove persistent XSS vulnerability in `commit_person_link` helper
Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.
Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126
Diffstat (limited to 'spec/helpers')
-rw-r--r-- | spec/helpers/commits_helper_spec.rb | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/spec/helpers/commits_helper_spec.rb b/spec/helpers/commits_helper_spec.rb new file mode 100644 index 00000000000..727c25ff529 --- /dev/null +++ b/spec/helpers/commits_helper_spec.rb @@ -0,0 +1,29 @@ +require 'rails_helper' + +describe CommitsHelper do + describe 'commit_author_link' do + it 'escapes the author email' do + commit = double( + author: nil, + author_name: 'Persistent XSS', + author_email: 'my@email.com" onmouseover="alert(1)' + ) + + expect(helper.commit_author_link(commit)). + not_to include('onmouseover="alert(1)"') + end + end + + describe 'commit_committer_link' do + it 'escapes the committer email' do + commit = double( + committer: nil, + committer_name: 'Persistent XSS', + committer_email: 'my@email.com" onmouseover="alert(1)' + ) + + expect(helper.commit_committer_link(commit)). + not_to include('onmouseover="alert(1)"') + end + end +end |