Merge branch 'port-iterations-sec' into 'master'

Escape html in iteration description

See merge request gitlab-org/gitlab!37340

ee/app/assets/javascripts/iterations/components/iteration_report.vue

@@ -157,7 +157,7 @@ export default {
         </gl-new-dropdown>
       </div>
       <h3 ref="title" class="page-title">{{ iteration.title }}</h3>
-      <div ref="description" v-html="iteration.description"></div>
+      <div ref="description" v-text="iteration.description"></div>
       <iteration-report-summary :group-path="groupPath" :iteration-id="iteration.id" />
       <iteration-report-tabs :group-path="groupPath" :iteration-id="iteration.id" />
     </template>

ee/spec/frontend/iterations/components/iteration_report_spec.js

@@ -91,5 +91,22 @@ describe('Iterations tabs', () => {
       expect(findTitle().text()).toContain(iteration.title);
       expect(findDescription().text()).toContain(iteration.description);
     });
+
+    it('escapes html in description', async () => {
+      wrapper.setData({
+        group: {
+          iteration: {
+            ...iteration,
+            description: `<img src=x onerror=alert(document.domain)>`,
+          },
+        },
+      });
+
+      await wrapper.vm.$nextTick();
+
+      expect(findDescription().html()).toEqual(
+        '<div>&lt;img src=x onerror=alert(document.domain)&gt;</div>',
+      );
+    });
   });
 });