Merge branch 'security-2717-fix-issue-title-xss' into 'master'

[master] Escape issue title while template rendering to prevent XSS

See merge request gitlab/gitlab-ee!696

app/assets/javascripts/gfm_auto_complete.js

@@ -208,7 +208,7 @@ class GfmAutoComplete {
       displayTpl(value) {
         let tmpl = GfmAutoComplete.Loading.template;
         if (value.title != null) {
-          tmpl = GfmAutoComplete.Issues.template;
+          tmpl = GfmAutoComplete.Issues.templateFunction(value.id, value.title);
         }
         return tmpl;
       },
@@ -274,7 +274,7 @@ class GfmAutoComplete {
       displayTpl(value) {
         let tmpl = GfmAutoComplete.Loading.template;
         if (value.title != null) {
-          tmpl = GfmAutoComplete.Issues.template;
+          tmpl = GfmAutoComplete.Issues.templateFunction(value.id, value.title);
         }
         return tmpl;
       },
@@ -377,7 +377,7 @@ class GfmAutoComplete {
       displayTpl(value) {
         let tmpl = GfmAutoComplete.Loading.template;
         if (value.title != null) {
-          tmpl = GfmAutoComplete.Issues.template;
+          tmpl = GfmAutoComplete.Issues.templateFunction(value.id, value.title);
         }
         return tmpl;
       },
@@ -564,8 +564,9 @@ GfmAutoComplete.Labels = {
 };
 // Issues, MergeRequests and Snippets
 GfmAutoComplete.Issues = {
-  // eslint-disable-next-line no-template-curly-in-string
-  template: '<li><small>${id}</small> ${title}</li>',
+  templateFunction(id, title) {
+    return `<li><small>${id}</small> ${_.escape(title)}</li>`;
+  },
 };
 // Milestones
 GfmAutoComplete.Milestones = {

ee/app/assets/javascripts/gfm_auto_complete_ee.js

@@ -9,7 +9,7 @@ const setupAutoCompleteEpics = ($input, defaultCallbacks) => {
     displayTpl(value) {
       let tmpl = GfmAutoComplete.Loading.template;
       if (value.title != null) {
-        tmpl = GfmAutoComplete.Issues.template;
+        tmpl = GfmAutoComplete.Issues.templateFunction(value.id, value.title);
       }
       return tmpl;
     },

ee/changelogs/unreleased/security-2717-fix-issue-title-xss.yml

+---
+title: Escape entity title while autocomplete template rendering to prevent XSS
+merge_request: 696
+author:
+type: security

spec/features/issues/gfm_autocomplete_spec.rb

@@ -35,6 +35,21 @@ describe 'GFM autocomplete', :js do
     expect(page).to have_selector('.atwho-container')
   end
 
+  it 'opens autocomplete menu when field starts with text with item escaping HTML characters' do
+    alert_title = 'This will execute alert<img src=x onerror=alert(2)&lt;img src=x onerror=alert(1)&gt;'
+    create(:issue, project: project, title: alert_title)
+
+    page.within '.timeline-content-form' do
+      find('#note-body').native.send_keys('#')
+    end
+
+    expect(page).to have_selector('.atwho-container')
+
+    page.within '.atwho-container #at-view-issues' do
+      expect(page.all('li').first.text).to include(alert_title)
+    end
+  end
+
   it 'doesnt open autocomplete menu character is prefixed with text' do
     page.within '.timeline-content-form' do
       find('#note-body').native.send_keys('testing')