From 304a2529db8963b06e16ea9df101ce0c07de702a Mon Sep 17 00:00:00 2001
From: Yorick Peterse <yorickpeterse@gmail.com>
Date: Thu, 24 Jan 2019 16:53:00 +0000
Subject: Merge branch '11-7-security-stored-xss-via-katex' into
 'security-11-7'

[11.7] Resolve "[Security] Stored XSS via KaTeX"

See merge request gitlab/gitlabhq!2820

(cherry picked from commit 53d5ce14f5b08a9733b8041b768ace2d1ec04d47)

63d8d0de 11.7 backport of fix for XSS in KaTex Links
699d42e4 Merge branch 'security-11-7' of https://dev.gitlab.org/gitlab/gitlabhq into...
---
 .../11-7-security-stored-xss-via-katex.yml         |  5 +++++
 package.json                                       |  2 +-
 spec/features/markdown/math_spec.rb                | 22 +++++++++++++++++++---
 yarn.lock                                          | 17 ++++++-----------
 4 files changed, 31 insertions(+), 15 deletions(-)
 create mode 100644 changelogs/unreleased/11-7-security-stored-xss-via-katex.yml

diff --git a/changelogs/unreleased/11-7-security-stored-xss-via-katex.yml b/changelogs/unreleased/11-7-security-stored-xss-via-katex.yml
new file mode 100644
index 00000000000..a71ae1123f2
--- /dev/null
+++ b/changelogs/unreleased/11-7-security-stored-xss-via-katex.yml
@@ -0,0 +1,5 @@
+---
+title: Fixed XSS content in KaTex links
+merge_request:
+author:
+type: security
diff --git a/package.json b/package.json
index ff1140128f8..3d0a130b3f1 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
     "js-cookie": "^2.1.3",
     "jszip": "^3.1.3",
     "jszip-utils": "^0.0.2",
-    "katex": "^0.9.0",
+    "katex": "^0.10.0",
     "marked": "^0.3.12",
     "mermaid": "^8.0.0-rc.8",
     "monaco-editor": "^0.14.3",
diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb
index 6a23d6b78ab..53abb5e3722 100644
--- a/spec/features/markdown/math_spec.rb
+++ b/spec/features/markdown/math_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe 'Math rendering', :js do
+  let!(:project)   { create(:project, :public) }
+
   it 'renders inline and display math correctly' do
     description = <<~MATH
       This math is inline $`a^2+b^2=c^2`$.
@@ -11,12 +13,26 @@ describe 'Math rendering', :js do
       ```
     MATH
 
-    project = create(:project, :public)
     issue = create(:issue, project: project, description: description)
 
     visit project_issue_path(project, issue)
 
-    expect(page).to have_selector('.katex .mord.mathit', text: 'b')
-    expect(page).to have_selector('.katex-display .mord.mathit', text: 'b')
+    expect(page).to have_selector('.katex .mord.mathdefault', text: 'b')
+    expect(page).to have_selector('.katex-display .mord.mathdefault', text: 'b')
+  end
+
+  it 'only renders non XSS links' do
+    description = <<~MATH
+      This link is valid $`\\href{javascript:alert('xss');}{xss}`$.
+
+      This link is valid $`\\href{https://gitlab.com}{Gitlab}`$.
+    MATH
+
+    issue = create(:issue, project: project, description: description)
+
+    visit project_issue_path(project, issue)
+
+    expect(page).to have_selector('.katex-error', text: "\href{javascript:alert('xss');}{xss}")
+    expect(page).to have_selector('.katex-html a', text: 'Gitlab')
   end
 end
diff --git a/yarn.lock b/yarn.lock
index fb1854265b5..95c87351018 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2279,7 +2279,7 @@ combined-stream@^1.0.6, combined-stream@~1.0.6:
   dependencies:
     delayed-stream "~1.0.0"
 
-commander@2, commander@^2.10.0, commander@^2.18.0, commander@^2.19.0:
+commander@2, commander@^2.10.0, commander@^2.16.0, commander@^2.18.0, commander@^2.19.0:
   version "2.19.0"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.19.0.tgz#f6198aa84e5b83c46054b94ddedbfed5ee9ff12a"
   integrity sha512-6tvAOO+D6OENvRAh524Dh9jcfKTYDQAqvqezbCW82xj5X0pSrcpxtvRKHLG0yBY6SD7PSDrJaj+0AiOcKVd1Xg==
@@ -6250,12 +6250,12 @@ karma@^3.0.0:
     tmp "0.0.33"
     useragent "2.2.1"
 
-katex@^0.9.0:
-  version "0.9.0"
-  resolved "https://registry.yarnpkg.com/katex/-/katex-0.9.0.tgz#26a7d082c21d53725422d2d71da9b2d8455fbd4a"
-  integrity sha512-lp3x90LT1tDZBW2tjLheJ98wmRMRjUHwk4QpaswT9bhqoQZ+XA4cPcjcQBxgOQNwaOSt6ZeL/a6GKQ1of3LFxQ==
+katex@^0.10.0:
+  version "0.10.0"
+  resolved "https://registry.yarnpkg.com/katex/-/katex-0.10.0.tgz#da562e5d0d5cc3aa602e27af8a9b8710bfbce765"
+  integrity sha512-/WRvx+L1eVBrLwX7QzKU1dQuaGnE7E8hDvx3VWfZh9HbMiCfsKWJNnYZ0S8ZMDAfAyDSofdyXIrH/hujF1fYXg==
   dependencies:
-    match-at "^0.1.1"
+    commander "^2.16.0"
 
 keyv@3.0.0:
   version "3.0.0"
@@ -6578,11 +6578,6 @@ marked@^0.3.12:
   resolved "https://registry.yarnpkg.com/marked/-/marked-0.3.12.tgz#7cf25ff2252632f3fe2406bde258e94eee927519"
   integrity sha512-k4NaW+vS7ytQn6MgJn3fYpQt20/mOgYM5Ft9BYMfQJDz2QT6yEeS9XJ8k2Nw8JTeWK/znPPW2n3UJGzyYEiMoA==
 
-match-at@^0.1.1:
-  version "0.1.1"
-  resolved "https://registry.yarnpkg.com/match-at/-/match-at-0.1.1.tgz#25d040d291777704d5e6556bbb79230ec2de0540"
-  integrity sha512-h4Yd392z9mST+dzc+yjuybOGFNOZjmXIPKWjxBd1Bb23r4SmDOsk2NYCU2BMUBGbSpZqwVsZYNq26QS3xfaT3Q==
-
 math-random@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/math-random/-/math-random-1.0.1.tgz#8b3aac588b8a66e4975e3cdea67f7bb329601fac"
-- 
cgit v1.2.3