diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2023-06-06 03:08:24 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2023-06-06 03:08:24 +0300 |
commit | bdad4dd5dabec7a0a611d5241fa2d56359884420 (patch) | |
tree | 333f5147c450cf0849823c7c42c7e52d70a0af74 /spec/helpers | |
parent | 96e23b2017cbe56969771960f6c274c5d3599397 (diff) |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'spec/helpers')
-rw-r--r-- | spec/helpers/merge_requests_helper_spec.rb | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/spec/helpers/merge_requests_helper_spec.rb b/spec/helpers/merge_requests_helper_spec.rb index 93df9d5f94b..b6c8653a563 100644 --- a/spec/helpers/merge_requests_helper_spec.rb +++ b/spec/helpers/merge_requests_helper_spec.rb @@ -183,10 +183,18 @@ RSpec.describe MergeRequestsHelper, feature_category: :code_review_workflow do end describe '#merge_request_source_branch' do - let_it_be(:project) { create(:project) } - let(:forked_project) { fork_project(project) } - let(:merge_request_forked) { create(:merge_request, source_project: forked_project, target_project: project) } + let(:malicious_branch_name) { 'name<script>test</script>' } + let(:project) { create(:project) } let(:merge_request) { create(:merge_request, source_project: project, target_project: project) } + let(:forked_project) { fork_project(project) } + let(:merge_request_forked) do + create( + :merge_request, + source_project: forked_project, + source_branch: malicious_branch_name, + target_project: project + ) + end context 'when merge request is a fork' do subject { merge_request_source_branch(merge_request_forked) } @@ -194,6 +202,10 @@ RSpec.describe MergeRequestsHelper, feature_category: :code_review_workflow do it 'does show the fork icon' do expect(subject).to match(/fork/) end + + it 'escapes properly' do + expect(subject).to include(html_escape(malicious_branch_name)) + end end context 'when merge request is not a fork' do |