Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
1
Merge Requests
1
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
nexedi
gitlab-ce
Commits
ad9898c4
Commit
ad9898c4
authored
Oct 09, 2019
by
Markus Koller
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
HTML-escape search term in empty message
parent
aa175994
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
8 additions
and
3 deletions
+8
-3
app/helpers/search_helper.rb
app/helpers/search_helper.rb
+1
-1
changelogs/unreleased/33668-fix-search-term-xss.yml
changelogs/unreleased/33668-fix-search-term-xss.yml
+5
-0
spec/helpers/search_helper_spec.rb
spec/helpers/search_helper_spec.rb
+2
-2
No files found.
app/helpers/search_helper.rb
View file @
ad9898c4
...
@@ -79,7 +79,7 @@ module SearchHelper
...
@@ -79,7 +79,7 @@ module SearchHelper
def
search_entries_empty_message
(
scope
,
term
)
def
search_entries_empty_message
(
scope
,
term
)
(
s_
(
"SearchResults|We couldn't find any %{scope} matching %{term}"
)
%
{
(
s_
(
"SearchResults|We couldn't find any %{scope} matching %{term}"
)
%
{
scope:
search_entries_scope_label
(
scope
,
0
),
scope:
search_entries_scope_label
(
scope
,
0
),
term:
"<code>
#{
term
}
</code>"
term:
"<code>
#{
h
(
term
)
}
</code>"
}).
html_safe
}).
html_safe
end
end
...
...
changelogs/unreleased/33668-fix-search-term-xss.yml
0 → 100644
View file @
ad9898c4
---
title
:
HTML-escape search term in empty message
merge_request
:
18319
author
:
type
:
security
spec/helpers/search_helper_spec.rb
View file @
ad9898c4
...
@@ -142,9 +142,9 @@ describe SearchHelper do
...
@@ -142,9 +142,9 @@ describe SearchHelper do
describe
'search_entries_empty_message'
do
describe
'search_entries_empty_message'
do
it
'returns the formatted entry message'
do
it
'returns the formatted entry message'
do
message
=
search_entries_empty_message
(
'projects'
,
'
foo
'
)
message
=
search_entries_empty_message
(
'projects'
,
'
<h1>foo</h1>
'
)
expect
(
message
).
to
eq
(
"We couldn't find any projects matching <code>
foo
</code>"
)
expect
(
message
).
to
eq
(
"We couldn't find any projects matching <code>
<h1>foo</h1>
</code>"
)
expect
(
message
).
to
be_html_safe
expect
(
message
).
to
be_html_safe
end
end
end
end
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment