7cc239528e
Because we were incorrectly supplying the tooltip title as `data-original-title` (which Bootstrap's Tooltip JS automatically applies based on the `title` attribute; we should never be setting it directly), the value was being passed through as-is. Instead, we should be supplying the normal `title` attribute and letting Rails escape the value, which also negates the need for us to call `sanitize` on it. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126
29 lines
745 B
Ruby
29 lines
745 B
Ruby
require 'rails_helper'
|
|
|
|
describe CommitsHelper do
|
|
describe 'commit_author_link' do
|
|
it 'escapes the author email' do
|
|
commit = double(
|
|
author: nil,
|
|
author_name: 'Persistent XSS',
|
|
author_email: 'my@email.com" onmouseover="alert(1)'
|
|
)
|
|
|
|
expect(helper.commit_author_link(commit)).
|
|
not_to include('onmouseover="alert(1)"')
|
|
end
|
|
end
|
|
|
|
describe 'commit_committer_link' do
|
|
it 'escapes the committer email' do
|
|
commit = double(
|
|
committer: nil,
|
|
committer_name: 'Persistent XSS',
|
|
committer_email: 'my@email.com" onmouseover="alert(1)'
|
|
)
|
|
|
|
expect(helper.commit_committer_link(commit)).
|
|
not_to include('onmouseover="alert(1)"')
|
|
end
|
|
end
|
|
end
|