Commit 7f25701b authored by Luke Duncalfe's avatar Luke Duncalfe Committed by Natalia Tepluhina

Correctly escape wiki commit message characters

https://gitlab.com/gitlab-org/gitlab/issues/35478
parent a15388de
...@@ -40,7 +40,7 @@ export default class Wikis { ...@@ -40,7 +40,7 @@ export default class Wikis {
// Replace hyphens with spaces // Replace hyphens with spaces
if (title) title = title.replace(/-+/g, ' '); if (title) title = title.replace(/-+/g, ' ');
const newCommitMessage = sprintf(this.commitMessageI18n, { pageTitle: title }); const newCommitMessage = sprintf(this.commitMessageI18n, { pageTitle: title }, false);
this.commitMessageInput.value = newCommitMessage; this.commitMessageInput.value = newCommitMessage;
} }
......
---
title: Auto generated wiki commit message containing HTML encoded entities
merge_request: 21371
author: 2knal
type: other
...@@ -83,15 +83,15 @@ describe 'User updates wiki page' do ...@@ -83,15 +83,15 @@ describe 'User updates wiki page' do
end end
it 'updates the commit message as the title is changed', :js do it 'updates the commit message as the title is changed', :js do
fill_in(:wiki_title, with: 'Wiki title') fill_in(:wiki_title, with: '& < > \ \ { } &')
expect(page).to have_field('wiki[message]', with: 'Update Wiki title') expect(page).to have_field('wiki[message]', with: 'Update & < > \ \ { } &')
end end
it 'does not allow XSS', :js do it 'correctly escapes the commit message entities', :js do
fill_in(:wiki_title, with: '<script>') fill_in(:wiki_title, with: 'Wiki title')
expect(page).to have_field('wiki[message]', with: 'Update &lt;script&gt;') expect(page).to have_field('wiki[message]', with: 'Update Wiki title')
end end
it 'shows a validation error message' do it 'shows a validation error message' do
......
...@@ -129,6 +129,18 @@ describe 'User views a wiki page' do ...@@ -129,6 +129,18 @@ describe 'User views a wiki page' do
end end
end end
context 'when a page has XSS in its message' do
before do
wiki_page.update(message: '<script>alert(true)<script>', content: 'XSS update')
end
it 'safely displays the message' do
visit(project_wiki_history_path(project, wiki_page))
expect(page).to have_content('<script>alert(true)<script>')
end
end
context 'when page has invalid content encoding' do context 'when page has invalid content encoding' do
let(:content) { (+'whatever').force_encoding('ISO-8859-1') } let(:content) { (+'whatever').force_encoding('ISO-8859-1') }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment