Merge branch 'security-fix-xss-in-milestone-tooltip' into 'master'

Escape milestone title in sidebar tooltip

Closes #187

See merge request gitlab-org/security/gitlab!719

app/helpers/issuables_helper.rb

@@ -29,7 +29,7 @@ module IssuablesHelper
   def sidebar_milestone_tooltip_label(milestone)
     return _('Milestone') unless milestone.present?
 
-    [milestone[:title], sidebar_milestone_remaining_days(milestone) || _('Milestone')].join('<br/>')
+    [escape_once(milestone[:title]), sidebar_milestone_remaining_days(milestone) || _('Milestone')].join('<br/>')
   end
 
   def sidebar_milestone_remaining_days(milestone)

changelogs/unreleased/security-fix-xss-in-milestone-tooltip.yml

+---
+title: Fix XSS in milestone tooltips
+merge_request:
+author:
+type: security

spec/helpers/issuables_helper_spec.rb

@@ -327,4 +327,12 @@ RSpec.describe IssuablesHelper do
       end
     end
   end
+
+  describe '#sidebar_milestone_tooltip_label' do
+    it 'escapes HTML in the milestone title' do
+      milestone = build(:milestone, title: '<img onerror=alert(1)>')
+
+      expect(helper.sidebar_milestone_tooltip_label(milestone)).to eq('&lt;img onerror=alert(1)&gt;<br/>Milestone')
+    end
+  end
 end