Merge branch 'fl-fix-milestone-bug-10-6' into 'security-10-6'

Escape miletone attribute when appending to the DOM

See merge request gitlab/gitlabhq!2359

1 files changed, 17 insertions, 0 deletions

diff --git a/spec/features/issues/form_spec.rb b/spec/features/issues/form_spec.rb
index ef6b8edd0ad..b08d8e4016b 100644
--- a/spec/features/issues/form_spec.rb
+++ b/spec/features/issues/form_spec.rb
@@ -226,6 +226,23 @@ describe 'New/edit issue', :js do
 
       expect(page).to have_selector('.atwho-view')
     end
+
+    describe 'milestone' do
+      let!(:milestone) { create(:milestone, title: '"><img src=x onerror=alert(document.domain)>', project: project) }
+
+      it 'escapes milestone' do
+        click_button 'Milestone'
+
+        page.within '.issue-milestone' do
+          click_link milestone.title
+        end
+
+        page.within '.js-milestone-select' do
+          expect(page).to have_content milestone.title
+          expect(page).not_to have_selector 'img'
+        end
+      end
+    end
   end
 
   context 'edit issue' do