3 files changed, 54 insertions, 1 deletions
diff --git a/spec/presenters/blob_presenter_spec.rb b/spec/presenters/blob_presenter_spec.rb
new file mode 100644
index 00000000000..e85e7a41017
--- /dev/null
+++ b/spec/presenters/blob_presenter_spec.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe BlobPresenter, :seed_helper do
+  let(:repository) { Gitlab::Git::Repository.new('default', TEST_REPO_PATH, '') }
+
+  let(:git_blob) do
+    Gitlab::Git::Blob.find(
+      repository,
+      'fa1b1e6c004a68b7d8763b86455da9e6b23e36d6',
+      'files/ruby/regex.rb'
+    )
+  end
+  let(:blob) { Blob.new(git_blob) }
+
+  describe '#highlight' do
+    subject { described_class.new(blob) }
+
+    it 'returns highlighted content' do
+      expect(Gitlab::Highlight).to receive(:highlight).with('files/ruby/regex.rb', git_blob.data, plain: nil, language: nil)
+
+      subject.highlight
+    end
+
+    it 'returns plain content when :plain is true' do
+      expect(Gitlab::Highlight).to receive(:highlight).with('files/ruby/regex.rb', git_blob.data, plain: true, language: nil)
+
+      subject.highlight(plain: true)
+    end
+
+    context 'gitlab-language contains a match' do
+      before do
+        allow(blob).to receive(:language_from_gitattributes).and_return('ruby')
+      end
+
+      it 'passes language to inner call' do
+        expect(Gitlab::Highlight).to receive(:highlight).with('files/ruby/regex.rb', git_blob.data, plain: nil, language: 'ruby')
+
+        subject.highlight
+      end
+    end
+  end
+end
diff --git a/spec/presenters/merge_request_presenter_spec.rb b/spec/presenters/merge_request_presenter_spec.rb
index a1b52d8692d..bafcddebbb7 100644
--- a/spec/presenters/merge_request_presenter_spec.rb
+++ b/spec/presenters/merge_request_presenter_spec.rb
@@ -403,6 +403,15 @@ describe MergeRequestPresenter do
       is_expected
         .to eq("<a href=\"/#{resource.source_project.full_path}/tree/#{resource.source_branch}\">#{resource.source_branch}</a>")
     end
+
+    it 'escapes html, when source_branch does not exist' do
+      xss_attempt = "<img src='x' onerror=alert('bad stuff') />"
+
+      allow(resource).to receive(:source_branch) { xss_attempt }
+      allow(resource).to receive(:source_branch_exists?) { false }
+
+      is_expected.to eq(ERB::Util.html_escape(xss_attempt))
+    end
   end
 
   describe '#rebase_path' do
diff --git a/spec/presenters/project_presenter_spec.rb b/spec/presenters/project_presenter_spec.rb
index 3eb2f149311..7b0192fa9c8 100644
--- a/spec/presenters/project_presenter_spec.rb
+++ b/spec/presenters/project_presenter_spec.rb
@@ -239,7 +239,7 @@ describe ProjectPresenter do
         expect(presenter.new_file_anchor_data).to have_attributes(enabled: false,
                                                                   label: "New file",
                                                                   link: presenter.project_new_blob_path(project, 'master'),
-                                                                  class_modifier: 'new')
+                                                                  class_modifier: 'success')
       end
 
       it 'returns nil if user cannot push' do