Commit b8f82ec8 authored by Markus Koller's avatar Markus Koller Committed by GitLab Release Tools Bot

Fix content injection in Jira issue title

Merge branch 'security-674-fix-jira-content-injection-14-10' into '14-10-stable-ee'

See merge request gitlab-org/security/gitlab!2464

Changelog: security
parent d118e6c4
...@@ -13,6 +13,10 @@ module Integrations ...@@ -13,6 +13,10 @@ module Integrations
jira_issue.summary jira_issue.summary
end end
expose :title_html do |jira_issue|
html_escape jira_issue.summary
end
expose :created_at do |jira_issue| expose :created_at do |jira_issue|
jira_issue.created.to_datetime.utc jira_issue.created.to_datetime.utc
end end
......
...@@ -79,6 +79,43 @@ RSpec.describe 'Jira issues list', :js do ...@@ -79,6 +79,43 @@ RSpec.describe 'Jira issues list', :js do
end end
end end
context 'when title or description contains HTML characters' do
let(:html) { '<script>foobar</script>' }
let(:escaped_html) { ERB::Util.html_escape(html) }
let(:issue) { build_issue(1).deep_merge(fields: { summary: html }) }
before do
stub_licensed_features(jira_issues_integration: true)
end
it 'escapes the HTML on issues#index' do
stub_issues([issue])
visit project_integrations_jira_issues_path(project)
expect(page).to have_text(html)
expect(page).not_to have_css('script', text: 'foobar')
expect(page.source).to include(escaped_html)
end
it 'escapes the HTML on issues#show' do
issue.deep_merge!(
fields: { comment: { comments: [] } },
renderedFields: { description: html },
duedate: Time.zone.now.to_s
)
stub_request(:get, /\A#{public_url}/)
.to_return(headers: { 'Content-Type' => 'application/json' }, body: issue.to_json)
visit project_integrations_jira_issue_path(project, 1)
expect(page).to have_text(html)
expect(page).not_to have_css('script', text: 'foobar')
expect(page.source).to include(escaped_html)
end
end
private private
def all_pages def all_pages
......
...@@ -26,7 +26,7 @@ RSpec.describe Integrations::JiraSerializers::IssueEntity do ...@@ -26,7 +26,7 @@ RSpec.describe Integrations::JiraSerializers::IssueEntity do
let(:jira_issue) do let(:jira_issue) do
double( double(
summary: 'Title', summary: 'Title with <h1>HTML</h1>',
created: '2020-06-25T15:39:30.000+0000', created: '2020-06-25T15:39:30.000+0000',
updated: '2020-06-26T15:38:32.000+0000', updated: '2020-06-26T15:38:32.000+0000',
resolutiondate: '2020-06-27T13:23:51.000+0000', resolutiondate: '2020-06-27T13:23:51.000+0000',
...@@ -46,7 +46,8 @@ RSpec.describe Integrations::JiraSerializers::IssueEntity do ...@@ -46,7 +46,8 @@ RSpec.describe Integrations::JiraSerializers::IssueEntity do
it 'returns the Jira issues attributes' do it 'returns the Jira issues attributes' do
expect(subject).to include( expect(subject).to include(
project_id: project.id, project_id: project.id,
title: 'Title', title: 'Title with <h1>HTML</h1>',
title_html: 'Title with &lt;h1&gt;HTML&lt;/h1&gt;',
created_at: '2020-06-25T15:39:30.000+0000'.to_datetime.utc, created_at: '2020-06-25T15:39:30.000+0000'.to_datetime.utc,
updated_at: '2020-06-26T15:38:32.000+0000'.to_datetime.utc, updated_at: '2020-06-26T15:38:32.000+0000'.to_datetime.utc,
closed_at: '2020-06-27T13:23:51.000+0000'.to_datetime.utc, closed_at: '2020-06-27T13:23:51.000+0000'.to_datetime.utc,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment