From 4acab552be05e2ee1ccb6ba1997b770dd89c42bd Mon Sep 17 00:00:00 2001 From: Douwe Maan Date: Mon, 4 Sep 2017 10:28:30 +0000 Subject: Merge branch 'fix-escape-commit-block' into 'security-9-5' [9.5] Prevent a persistent XSS in the commit author block See merge request gitlab/gitlabhq!2180 --- app/helpers/commits_helper.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'app/helpers/commits_helper.rb') diff --git a/app/helpers/commits_helper.rb b/app/helpers/commits_helper.rb index 9651f9733f9..08fb9db6c0f 100644 --- a/app/helpers/commits_helper.rb +++ b/app/helpers/commits_helper.rb @@ -137,7 +137,7 @@ module CommitsHelper text = if options[:avatar] - %Q{#{person_name}} + content_tag(:span, person_name, class: "commit-#{options[:source]}-name") else person_name end @@ -148,9 +148,9 @@ module CommitsHelper } if user.nil? - mail_to(source_email, text.html_safe, options) + mail_to(source_email, text, options) else - link_to(text.html_safe, user_path(user), options) + link_to(text, user_path(user), options) end end -- cgit v1.2.3