kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Fix requests profiler in admin page not rendering HTML properly

Browse source 
By default in Rails 5, content passed to `render` will be
escaped. This doesn't work for the HTML profile output, which
should be considered safe HTML already.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56152
This commit is contained in:
Stan Hu 2019-01-09 22:50:51 -08:00
parent 4a6c7661ed
commit 4ac4ba2654
3 changed files with 53 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/admin/requests_profiles_controller.rb
View file

@ -11,7 +11,7 @@ class Admin::RequestsProfilesController < Admin::ApplicationController
profile = Gitlab::RequestProfiler::Profile.find(clean_name) profile = Gitlab::RequestProfiler::Profile.find(clean_name)
if profile if profile
render html: profile.content render html: profile.content.html_safe
else else
redirect_to admin_requests_profiles_path, alert: 'Profile not found' redirect_to admin_requests_profiles_path, alert: 'Profile not found'
end end

5
changelogs/unreleased/sh-fix-request-profiles-html.yml Normal file
View file

@ -0,0 +1,5 @@
---
title: Fix requests profiler in admin page not rendering HTML properly
merge_request: 24291
author:
type: fixed

47
spec/controllers/admin/requests_profiles_controller_spec.rb Normal file
View file

@ -0,0 +1,47 @@
# frozen_string_literal: true
require 'spec_helper'
describe Admin::RequestsProfilesController do
set(:admin) { create(:admin) }
before do
sign_in(admin)
end
describe '#show' do
let(:basename) { "profile_#{Time.now.to_i}.html" }
let(:tmpdir) { Dir.mktmpdir('profiler-test') }
let(:test_file) { File.join(tmpdir, basename) }
let(:profile) { Gitlab::RequestProfiler::Profile.new(basename) }
let(:sample_data) do
<<~HTML
<!DOCTYPE html>
<html>
<body>
<h1>My First Heading</h1>
<p>My first paragraph.</p>
</body>
</html>
HTML
end
before do
stub_const('Gitlab::RequestProfiler::PROFILES_DIR', tmpdir)
output = File.open(test_file, 'w')
output.write(sample_data)
output.close
end
after do
File.unlink(test_file)
end
it 'loads an HTML profile' do
get :show, params: { name: basename }
expect(response).to have_gitlab_http_status(200)
expect(response.body).to eq(sample_data)
end
end
end