1 files changed, 5 insertions, 0 deletions
diff --git a/lib/api/markdown.rb b/lib/api/markdown.rb
index 276560f3433..f348e20cc0b 100644
--- a/lib/api/markdown.rb
+++ b/lib/api/markdown.rb
@@ -35,6 +35,11 @@ module API
           context[:skip_project_check] = true
         end
 
+        # Disable comments in markdown for IE browsers because comments in IE
+        # could allow script execution.
+        browser = Browser.new(headers['User-Agent'])
+        context[:allow_comments] = !browser.ie?
+
         present({ html: Banzai.render_and_post_process(params[:text], context) }, with: Entities::Markdown)
       end
     end