diff options
author | Heinrich Lee Yu <heinrich@gitlab.com> | 2019-10-26 09:06:59 +0300 |
---|---|---|
committer | Heinrich Lee Yu <heinrich@gitlab.com> | 2019-11-25 08:17:31 +0300 |
commit | 54564e79d311f06cbf279d137d6d517efc5c9fb2 (patch) | |
tree | 55db552337ecc543c861d14ad5ec6397e31389c6 /spec/lib/banzai | |
parent | 33c89fa9c7473f6eca7839697c8673d52087c42a (diff) |
Escape namespace in label references
When referencing cross-namespace labels, we append the namespace name
to the rendered label.
This MR escapes the name to prevent XSS attacks.
Diffstat (limited to 'spec/lib/banzai')
-rw-r--r-- | spec/lib/banzai/filter/label_reference_filter_spec.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/spec/lib/banzai/filter/label_reference_filter_spec.rb b/spec/lib/banzai/filter/label_reference_filter_spec.rb index 35e99d2586e..66af26bc51c 100644 --- a/spec/lib/banzai/filter/label_reference_filter_spec.rb +++ b/spec/lib/banzai/filter/label_reference_filter_spec.rb @@ -521,6 +521,15 @@ describe Banzai::Filter::LabelReferenceFilter do expect(reference_filter(act).to_html).to eq exp end + + context 'when group name has HTML entities' do + let(:another_group) { create(:group, name: '<img src=x onerror=alert(1)>', path: 'another_group') } + + it 'escapes the HTML entities' do + expect(result.text) + .to eq "See #{group_label.name} in #{another_project.full_name}" + end + end end describe 'cross-project / same-group_label complete reference' do |