kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Escaping the object_link_text on cross project milestone references

Browse source
This commit is contained in:
Alejandro Rodríguez 2016-04-04 23:09:44 -03:00
parent 6d9794d42a
commit 1ff896f2bf
2 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/banzai/filter/milestone_reference_filter.rb
View file

@ -39,7 +39,7 @@ module Banzai
if context[:project] == object.project
super
else
"#{super} <i>in #{escape_once(object.project.name_with_namespace)}</i>".
"#{escape_once(super)} <i>in #{escape_once(object.project.name_with_namespace)}</i>".
html_safe
end
end

6
spec/lib/banzai/filter/milestone_reference_filter_spec.rb
View file

@ -176,5 +176,11 @@ describe Banzai::Filter::MilestoneReferenceFilter, lib: true do
it 'contains cross project content' do
expect(result.css('a').first.text).to eq "#{milestone.name} in #{project_name}"
end
it 'escapes the name attribute' do
allow_any_instance_of(Milestone).to receive(:title).and_return(%{"></a>whatever<a title="})
doc = reference_filter("See #{reference}")
expect(doc.css('a').first.text).to eq "#{milestone.name} in #{project_name}"
end
end
end