gitlab-org--gitlab-foss/changelogs/unreleased/security-60143-address-xss-...

---
title: Filter relative links in wiki for XSS
merge_request:
author:
type: security
Reject slug+uri concat if slug is deemed unsafe First reported: https://gitlab.com/gitlab-org/gitlab-ce/issues/60143 When the page slug is "javascript:" and we attempt to link to a relative path (using `.` or `..`) the code will concatenate the slug and the uri. This MR adds a guard to that concat step that will return `nil` if the incoming slug matches against any of the "unsafe" slug regexes; currently this is only for the slug "javascript:" but can be extended if needed. Manually tested against a non-exhaustive list from OWASP of common javascript XSS exploits that have to to with mangling the "javascript:" method, and all are caught by this change or by existing code that ingests the user-specified slug. 2019-05-20 20:24:22 +00:00			`---`
			`title: Filter relative links in wiki for XSS`
			`merge_request:`
			`author:`
			`type: security`