diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-11-26 15:01:56 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-11-26 15:01:56 +0300 |
commit | 5f9de1e04140d0a556cd2164ff644ca5fe5c02d2 (patch) | |
tree | a463261a4a5953e80e8533a1bd14bb423f5dc475 /spec | |
parent | 70911c7c43f5bc804156c701b3a4ba9b992548b3 (diff) | |
parent | ad48a55cc22864e97f5a616a3aafc953e8c43ff2 (diff) |
Merge branch 'security-fix-xss-in-label-namespace-12-5' into '12-5-stable'
Escape namespace in label references
See merge request gitlab/gitlabhq!3550
Diffstat (limited to 'spec')
-rw-r--r-- | spec/lib/banzai/filter/label_reference_filter_spec.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/spec/lib/banzai/filter/label_reference_filter_spec.rb b/spec/lib/banzai/filter/label_reference_filter_spec.rb index 35e99d2586e..66af26bc51c 100644 --- a/spec/lib/banzai/filter/label_reference_filter_spec.rb +++ b/spec/lib/banzai/filter/label_reference_filter_spec.rb @@ -521,6 +521,15 @@ describe Banzai::Filter::LabelReferenceFilter do expect(reference_filter(act).to_html).to eq exp end + + context 'when group name has HTML entities' do + let(:another_group) { create(:group, name: '<img src=x onerror=alert(1)>', path: 'another_group') } + + it 'escapes the HTML entities' do + expect(result.text) + .to eq "See #{group_label.name} in #{another_project.full_name}" + end + end end describe 'cross-project / same-group_label complete reference' do |