Merge branch 'security-ide-branch-name-xss-11-1' into 'security-11-1'

[11.1] Fixed XSS in branch name in Web IDE

See merge request gitlab/gitlabhq!2446

app/assets/javascripts/ide/components/commit_sidebar/actions.vue

 <script>
+import _ from 'underscore';
 import { mapActions, mapState, mapGetters } from 'vuex';
 import { sprintf, __ } from '~/locale';
 import * as consts from '../../stores/modules/commit/constants';
@@ -14,7 +15,7 @@ export default {
     commitToCurrentBranchText() {
       return sprintf(
         __('Commit to %{branchName} branch'),
-        { branchName: `<strong class="monospace">${this.currentBranchId}</strong>` },
+        { branchName: `<strong class="monospace">${_.escape(this.currentBranchId)}</strong>` },
         false,
       );
     },

changelogs/unreleased/security-ide-branch-name-xss.yml

+---
+title: Fixed XSS in branch name in Web IDE
+merge_request:
+author:
+type: security

spec/javascripts/ide/components/commit_sidebar/actions_spec.js

@@ -46,4 +46,12 @@ describe('IDE commit sidebar actions', () => {
       done();
     });
   });
+
+  describe('commitToCurrentBranchText', () => {
+    it('escapes current branch', () => {
+      vm.$store.state.currentBranchId = '<img src="x" />';
+
+      expect(vm.commitToCurrentBranchText).not.toContain('<img src="x" />');
+    });
+  });
 });