Escapes milestone and label names when promoting them
This commit is contained in:
parent
fc9f90045d
commit
a0930b83ec
|
@ -112,7 +112,7 @@ class Projects::LabelsController < Projects::ApplicationController
|
|||
begin
|
||||
return render_404 unless promote_service.execute(@label)
|
||||
|
||||
flash[:notice] = "#{@label.title} promoted to <a href=\"#{group_labels_path(@project.group)}\">group label</a>.".html_safe
|
||||
flash[:notice] = flash_notice_for(@label, @project.group)
|
||||
respond_to do |format|
|
||||
format.html do
|
||||
redirect_to(project_labels_path(@project), status: :see_other)
|
||||
|
@ -135,6 +135,15 @@ class Projects::LabelsController < Projects::ApplicationController
|
|||
end
|
||||
end
|
||||
|
||||
def flash_notice_for(label, group)
|
||||
notice = ''.html_safe
|
||||
notice << label.title
|
||||
notice << ' promoted to '
|
||||
notice << view_context.link_to('<u>group label</u>'.html_safe, group_labels_path(group))
|
||||
notice << '.'
|
||||
notice
|
||||
end
|
||||
|
||||
protected
|
||||
|
||||
def label_params
|
||||
|
|
|
@ -1,5 +1,4 @@
|
|||
class Projects::MilestonesController < Projects::ApplicationController
|
||||
include ActionView::Helpers::SanitizeHelper
|
||||
include Gitlab::Utils::StrongMemoize
|
||||
include MilestoneActions
|
||||
|
||||
|
@ -77,8 +76,8 @@ class Projects::MilestonesController < Projects::ApplicationController
|
|||
|
||||
def promote
|
||||
promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone)
|
||||
milestone_title = sanitize(milestone.title)
|
||||
flash[:notice] = "#{milestone_title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe
|
||||
flash[:notice] = flash_notice_for(promoted_milestone, project.group)
|
||||
|
||||
respond_to do |format|
|
||||
format.html do
|
||||
redirect_to project_milestones_path(project)
|
||||
|
@ -91,6 +90,15 @@ class Projects::MilestonesController < Projects::ApplicationController
|
|||
redirect_to milestone, alert: error.message
|
||||
end
|
||||
|
||||
def flash_notice_for(milestone, group)
|
||||
notice = ''.html_safe
|
||||
notice << milestone.title
|
||||
notice << ' promoted to '
|
||||
notice << view_context.link_to('<u>group milestone</u>'.html_safe, group_milestone_path(group, milestone.iid))
|
||||
notice << '.'
|
||||
notice
|
||||
end
|
||||
|
||||
def destroy
|
||||
return access_denied! unless can?(current_user, :admin_milestone, @project)
|
||||
|
||||
|
|
|
@ -143,6 +143,14 @@ describe Projects::LabelsController do
|
|||
expect(GroupLabel.find_by(title: promoted_label_name)).not_to be_nil
|
||||
end
|
||||
|
||||
it 'renders label name without parsing it as HTML' do
|
||||
label_1.update!(name: 'CCC<img src=x onerror=alert(document.domain)>')
|
||||
|
||||
post :promote, namespace_id: project.namespace.to_param, project_id: project, id: label_1.to_param
|
||||
|
||||
expect(flash[:notice]).to eq("CCC<img src=x onerror=alert(document.domain)> promoted to <a href=\"#{group_labels_path(project.group)}\"><u>group label</u></a>.")
|
||||
end
|
||||
|
||||
context 'service raising InvalidRecord' do
|
||||
before do
|
||||
expect_any_instance_of(Labels::PromoteService).to receive(:execute) do |label|
|
||||
|
|
|
@ -133,7 +133,7 @@ describe Projects::MilestonesController do
|
|||
|
||||
post :promote, namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid
|
||||
|
||||
expect(flash[:notice]).to eq("CCC<img src=\"x\"> promoted to <a href=\"#{group_milestone_path(project.group, milestone.iid)}\"><u>group milestone</u></a>.")
|
||||
expect(flash[:notice]).to eq("CCC promoted to <a href=\"#{group_milestone_path(project.group, milestone.iid)}\"><u>group milestone</u></a>.")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
Loading…
Reference in New Issue