diff options
author | Phil Hughes <me@iamphill.com> | 2018-04-18 10:40:36 +0300 |
---|---|---|
committer | Mayra Cabrera <mcabrera@gitlab.com> | 2018-04-30 23:01:01 +0300 |
commit | 2f7b71df7619768220657ed47c7737f4c3e19e90 (patch) | |
tree | 58dfea9291271147164b6a2151635b31f23af6f0 /spec/javascripts/sidebar | |
parent | 9cf4e4734192c7234a97f1a7f472eed3ce7a2448 (diff) |
Merge branch '10-7-security_issue_42029' into 'security-10-7'
Sanitize user name to avoid XSS attacks
See merge request gitlab/gitlabhq!2373
Diffstat (limited to 'spec/javascripts/sidebar')
-rw-r--r-- | spec/javascripts/sidebar/mock_data.js | 2 | ||||
-rw-r--r-- | spec/javascripts/sidebar/sidebar_move_issue_spec.js | 9 |
2 files changed, 10 insertions, 1 deletions
diff --git a/spec/javascripts/sidebar/mock_data.js b/spec/javascripts/sidebar/mock_data.js index 8b6e8b24f00..fcd7bea3f6d 100644 --- a/spec/javascripts/sidebar/mock_data.js +++ b/spec/javascripts/sidebar/mock_data.js @@ -138,7 +138,7 @@ const RESPONSE_MAP = { }, { id: 20, - name_with_namespace: 'foo / bar', + name_with_namespace: '<img src=x onerror=alert(document.domain)> foo / bar', }, ], }, diff --git a/spec/javascripts/sidebar/sidebar_move_issue_spec.js b/spec/javascripts/sidebar/sidebar_move_issue_spec.js index a3fb965fbab..00847df4b60 100644 --- a/spec/javascripts/sidebar/sidebar_move_issue_spec.js +++ b/spec/javascripts/sidebar/sidebar_move_issue_spec.js @@ -69,6 +69,15 @@ describe('SidebarMoveIssue', function () { expect($.fn.glDropdown).toHaveBeenCalled(); }); + + it('escapes html from project name', (done) => { + this.$toggleButton.dropdown('toggle'); + + setTimeout(() => { + expect(this.$content.find('.js-move-issue-dropdown-item')[1].innerHTML.trim()).toEqual('<img src=x onerror=alert(document.domain)> foo / bar'); + done(); + }); + }); }); describe('onConfirmClicked', () => { |