diff --git a/app/controllers/projects/labels_controller.rb b/app/controllers/projects/labels_controller.rb
index 21d3c918581..ce03b2d8d1d 100644
--- a/app/controllers/projects/labels_controller.rb
+++ b/app/controllers/projects/labels_controller.rb
@@ -112,7 +112,7 @@ class Projects::LabelsController < Projects::ApplicationController
begin
return render_404 unless promote_service.execute(@label)
- flash[:notice] = "#{@label.title} promoted to group label.".html_safe
+ flash[:notice] = flash_notice_for(@label, @project.group)
respond_to do |format|
format.html do
redirect_to(project_labels_path(@project), status: :see_other)
@@ -135,6 +135,15 @@ class Projects::LabelsController < Projects::ApplicationController
end
end
+ def flash_notice_for(label, group)
+ notice = ''.html_safe
+ notice << label.title
+ notice << ' promoted to '
+ notice << view_context.link_to('group label'.html_safe, group_labels_path(group))
+ notice << '.'
+ notice
+ end
+
protected
def label_params
diff --git a/app/controllers/projects/milestones_controller.rb b/app/controllers/projects/milestones_controller.rb
index 17571935c1c..b9b3dcd5a85 100644
--- a/app/controllers/projects/milestones_controller.rb
+++ b/app/controllers/projects/milestones_controller.rb
@@ -1,5 +1,4 @@
class Projects::MilestonesController < Projects::ApplicationController
- include ActionView::Helpers::SanitizeHelper
include Gitlab::Utils::StrongMemoize
include MilestoneActions
@@ -77,8 +76,8 @@ class Projects::MilestonesController < Projects::ApplicationController
def promote
promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone)
- milestone_title = sanitize(milestone.title)
- flash[:notice] = "#{milestone_title} promoted to group milestone.".html_safe
+ flash[:notice] = flash_notice_for(promoted_milestone, project.group)
+
respond_to do |format|
format.html do
redirect_to project_milestones_path(project)
@@ -91,6 +90,15 @@ class Projects::MilestonesController < Projects::ApplicationController
redirect_to milestone, alert: error.message
end
+ def flash_notice_for(milestone, group)
+ notice = ''.html_safe
+ notice << milestone.title
+ notice << ' promoted to '
+ notice << view_context.link_to('group milestone'.html_safe, group_milestone_path(group, milestone.iid))
+ notice << '.'
+ notice
+ end
+
def destroy
return access_denied! unless can?(current_user, :admin_milestone, @project)
diff --git a/spec/controllers/projects/labels_controller_spec.rb b/spec/controllers/projects/labels_controller_spec.rb
index 273702e6d21..e03d23bcdf6 100644
--- a/spec/controllers/projects/labels_controller_spec.rb
+++ b/spec/controllers/projects/labels_controller_spec.rb
@@ -143,6 +143,14 @@ describe Projects::LabelsController do
expect(GroupLabel.find_by(title: promoted_label_name)).not_to be_nil
end
+ it 'renders label name without parsing it as HTML' do
+ label_1.update!(name: 'CCC<img src=x onerror=alert(document.domain)>')
+
+ post :promote, namespace_id: project.namespace.to_param, project_id: project, id: label_1.to_param
+
+ expect(flash[:notice]).to eq("CCC<img src=x onerror=alert(document.domain)> promoted to group label.")
+ end
+
context 'service raising InvalidRecord' do
before do
expect_any_instance_of(Labels::PromoteService).to receive(:execute) do |label|
diff --git a/spec/controllers/projects/milestones_controller_spec.rb b/spec/controllers/projects/milestones_controller_spec.rb
index e351e0fe07d..6c2d1c7e92b 100644
--- a/spec/controllers/projects/milestones_controller_spec.rb
+++ b/spec/controllers/projects/milestones_controller_spec.rb
@@ -133,7 +133,7 @@ describe Projects::MilestonesController do
post :promote, namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid
- expect(flash[:notice]).to eq("CCC promoted to group milestone.")
+ expect(flash[:notice]).to eq("CCC promoted to group milestone.")
end
end