Merge branch 'security-label-xss' into 'master'

[master] Escape html entities when no label found See merge request gitlab/gitlabhq!2706

Merge branch 'security-label-xss' into 'master'
[master] Escape html entities when no label found See merge request gitlab/gitlabhq!2706
90e1f10f · John Jarvis · a7470017 · a1d69ab6 · 90e1f10f · 90e1f10f
Commit 90e1f10f authored Jan 02, 2019 by John Jarvis
3 changed files
--- a/changelogs/unreleased/54427-label-xss.yml
+++ b/changelogs/unreleased/54427-label-xss.yml
+---
+title: Escape html entities in LabelReferenceFilter when no label found
+merge_request:
+author:
+type: security
--- a/lib/banzai/filter/label_reference_filter.rb
+++ b/lib/banzai/filter/label_reference_filter.rb
@@ -29,7 +29,7 @@ module Banzai
          if label
            yield match, label.id, project, namespace, $~
          else
-            match
+            escape_html_entities(match)
          end
        end
      end
@@ -102,6 +102,10 @@ module Banzai
        CGI.unescapeHTML(text.to_s)
      end
+      def escape_html_entities(text)
+        CGI.escapeHTML(text.to_s)
+      end
      def object_link_title(object, matches)
        # use title of wrapped element instead
        nil

--- a/spec/lib/banzai/filter/label_reference_filter_spec.rb
+++ b/spec/lib/banzai/filter/label_reference_filter_spec.rb
@@ -236,6 +236,24 @@ describe Banzai::Filter::LabelReferenceFilter do
    end
  end
+  context 'References with html entities' do
+    let!(:label)     { create(:label, name: '&lt;html&gt;', project: project) }
+    it 'links to a valid reference' do
+      doc = reference_filter('See ~"&lt;html&gt;"')
+      expect(doc.css('a').first.attr('href')).to eq urls
+        .project_issues_url(project, label_name: label.name)
+      expect(doc.text).to eq 'See <html>'
+    end
+    it 'ignores invalid label names and escapes entities' do
+      act = %(Label #{Label.reference_prefix}"&lt;non valid&gt;")
+      expect(reference_filter(act).to_html).to eq act
+    end
+  end
  describe 'consecutive references' do
    let(:bug) { create(:label, name: 'bug', project: project) }
    let(:feature_proposal) { create(:label, name: 'feature proposal', project: project) }