kotovalexarian-likes-gitlab
/
gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Use sanitized user status message for user popover

This commit is contained in:
Dennis Tang 2019-01-22 22:10:48 +00:00 committed by Yorick Peterse
parent 88f2e9615c
commit 1658f5b62e
No known key found for this signature in database
GPG Key ID: EDD30D2BEB691AC9
3 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/assets/javascripts/vue_shared/components/user_popover/user_popover.vue
View File

@ -28,10 +28,10 @@ export default {
}, },
computed: { computed: {
statusHtml() { statusHtml() {
if (this.user.status.emoji && this.user.status.message) { if (this.user.status.emoji && this.user.status.message_html) {
return `${glEmojiTag(this.user.status.emoji)} ${this.user.status.message}`; return `${glEmojiTag(this.user.status.emoji)} ${this.user.status.message_html}`;
} else if (this.user.status.message) { } else if (this.user.status.message_html) {
return this.user.status.message; return this.user.status.message_html;
} }
return ''; return '';
}, },

5
changelogs/unreleased/security-55320-stored-xss-in-user-status.yml Normal file
View File

@ -0,0 +1,5 @@
---
title: Use sanitized user status message for user popover
merge_request:
author:
type: security

6
spec/javascripts/vue_shared/components/user_popover/user_popover_spec.js
View File

@ -122,7 +122,7 @@ describe('User Popover Component', () => {
describe('status data', () => { describe('status data', () => {
it('should show only message', () => { it('should show only message', () => {
const testProps = Object.assign({}, DEFAULT_PROPS); const testProps = Object.assign({}, DEFAULT_PROPS);
testProps.user.status = { message: 'Hello World' }; testProps.user.status = { message_html: 'Hello World' };
vm = mountComponent(UserPopover, { vm = mountComponent(UserPopover, {
...DEFAULT_PROPS, ...DEFAULT_PROPS,
@ -134,12 +134,12 @@ describe('User Popover Component', () => {
it('should show message and emoji', () => { it('should show message and emoji', () => {
const testProps = Object.assign({}, DEFAULT_PROPS); const testProps = Object.assign({}, DEFAULT_PROPS);
testProps.user.status = { emoji: 'basketball_player', message: 'Hello World' }; testProps.user.status = { emoji: 'basketball_player', message_html: 'Hello World' };
vm = mountComponent(UserPopover, { vm = mountComponent(UserPopover, {
...DEFAULT_PROPS, ...DEFAULT_PROPS,
target: document.querySelector('.js-user-link'), target: document.querySelector('.js-user-link'),
status: { emoji: 'basketball_player', message: 'Hello World' }, status: { emoji: 'basketball_player', message_html: 'Hello World' },
}); });
expect(vm.$el.textContent).toContain('Hello World'); expect(vm.$el.textContent).toContain('Hello World');