diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-07-28 11:36:01 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-07-28 11:36:01 +0300 |
commit | f415ebdb978c4eb976d07664219c788918120d59 (patch) | |
tree | e1c4c45aa86e7d3f3da88030b892764fff3bc0ff /spec/serializers/build_details_entity_spec.rb | |
parent | 559f55766c23b0593474dcf0c147ee003726e8a0 (diff) |
Add latest changes from gitlab-org/security/gitlab@15-0-stable-eev15.0.5
Diffstat (limited to 'spec/serializers/build_details_entity_spec.rb')
-rw-r--r-- | spec/serializers/build_details_entity_spec.rb | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/spec/serializers/build_details_entity_spec.rb b/spec/serializers/build_details_entity_spec.rb index dd8238456aa..916798c669c 100644 --- a/spec/serializers/build_details_entity_spec.rb +++ b/spec/serializers/build_details_entity_spec.rb @@ -170,6 +170,24 @@ RSpec.describe BuildDetailsEntity do expect(message).to include('could not retrieve the needed artifacts.') end end + + context 'when dependency contains invalid dependency names' do + invalid_name = 'XSS<a href=# data-disable-with="<img src=x onerror=alert(document.domain)>">' + let!(:test1) { create(:ci_build, :success, :expired, pipeline: pipeline, name: invalid_name, stage_idx: 0) } + let!(:build) { create(:ci_build, :pending, pipeline: pipeline, stage_idx: 1, options: { dependencies: [invalid_name] }) } + + before do + build.pipeline.unlocked! + build.drop!(:missing_dependency_failure) + end + + it { is_expected.to include(failure_reason: 'missing_dependency_failure') } + + it 'escapes the invalid dependency names' do + escaped_name = html_escape(invalid_name) + expect(message).to include(escaped_name) + end + end end context 'when a build has environment with latest deployment' do |