kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Escapes milestone title shown in flash message when promoting a milestone

Browse source
This commit is contained in:
Filipa Lacerda 2018-07-12 15:58:33 +01:00
parent cfe2121978
commit fc9f90045d
No known key found for this signature in database
GPG key ID: 9CA3FDE4D1E2F1C8
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/projects/milestones_controller.rb
View file

@ -1,4 +1,5 @@
class Projects::MilestonesController < Projects::ApplicationController class Projects::MilestonesController < Projects::ApplicationController
include ActionView::Helpers::SanitizeHelper
include Gitlab::Utils::StrongMemoize include Gitlab::Utils::StrongMemoize
include MilestoneActions include MilestoneActions
@ -76,8 +77,8 @@ class Projects::MilestonesController < Projects::ApplicationController
def promote def promote
promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone) promoted_milestone = Milestones::PromoteService.new(project, current_user).execute(milestone)
milestone_title = sanitize(milestone.title)
flash[:notice] = "#{milestone.title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe flash[:notice] = "#{milestone_title} promoted to <a href=\"#{group_milestone_path(project.group, promoted_milestone.iid)}\"><u>group milestone</u></a>.".html_safe
respond_to do |format| respond_to do |format|
format.html do format.html do
redirect_to project_milestones_path(project) redirect_to project_milestones_path(project)

8
spec/controllers/projects/milestones_controller_spec.rb
View file

@ -127,6 +127,14 @@ describe Projects::MilestonesController do
expect(flash[:notice]).to eq("#{milestone.title} promoted to <a href=\"#{group_milestone_path(project.group, milestone.iid)}\"><u>group milestone</u></a>.") expect(flash[:notice]).to eq("#{milestone.title} promoted to <a href=\"#{group_milestone_path(project.group, milestone.iid)}\"><u>group milestone</u></a>.")
expect(response).to redirect_to(project_milestones_path(project)) expect(response).to redirect_to(project_milestones_path(project))
end end
it 'renders milestone name without parsing it as HTML' do
milestone.update!(name: 'CCC&lt;img src=x onerror=alert(document.domain)&gt;')
post :promote, namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid
expect(flash[:notice]).to eq("CCC<img src=\"x\"> promoted to <a href=\"#{group_milestone_path(project.group, milestone.iid)}\"><u>group milestone</u></a>.")
end
end end
context 'promotion fails' do context 'promotion fails' do