Merge branch '11-6-security-stored-xss-via-katex' into 'security-11-6'

[11.6] Resolve "[Security] Stored XSS via KaTeX"

See merge request gitlab/gitlabhq!2755

(cherry picked from commit f79ff59ee1e21a5dbff19b86c5d5af16b62ac894)

024098db 11.6 backport of fix for XSS in KaTex Links
37b798d7 Merge branch 'security-11-6' of https://dev.gitlab.org/gitlab/gitlabhq into...

1 files changed, 19 insertions, 3 deletions

diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb
index 6a23d6b78ab..53abb5e3722 100644
--- a/spec/features/markdown/math_spec.rb
+++ b/spec/features/markdown/math_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe 'Math rendering', :js do
+  let!(:project)   { create(:project, :public) }
+
   it 'renders inline and display math correctly' do
     description = <<~MATH
       This math is inline $`a^2+b^2=c^2`$.
@@ -11,12 +13,26 @@ describe 'Math rendering', :js do
       ```
     MATH
 
-    project = create(:project, :public)
     issue = create(:issue, project: project, description: description)
 
     visit project_issue_path(project, issue)
 
-    expect(page).to have_selector('.katex .mord.mathit', text: 'b')
-    expect(page).to have_selector('.katex-display .mord.mathit', text: 'b')
+    expect(page).to have_selector('.katex .mord.mathdefault', text: 'b')
+    expect(page).to have_selector('.katex-display .mord.mathdefault', text: 'b')
+  end
+
+  it 'only renders non XSS links' do
+    description = <<~MATH
+      This link is valid $`\\href{javascript:alert('xss');}{xss}`$.
+
+      This link is valid $`\\href{https://gitlab.com}{Gitlab}`$.
+    MATH
+
+    issue = create(:issue, project: project, description: description)
+
+    visit project_issue_path(project, issue)
+
+    expect(page).to have_selector('.katex-error', text: "\href{javascript:alert('xss');}{xss}")
+    expect(page).to have_selector('.katex-html a', text: 'Gitlab')
   end
 end