Commit cd6692fe authored by Philip Cunningham's avatar Philip Cunningham Committed by Markus Koller

Use new Sanitizable concern in NamespaceSetting

- Includes and uses new concern
- Adds specs to capture behaviour
parent 9bc09614
...@@ -2,6 +2,7 @@ ...@@ -2,6 +2,7 @@
class NamespaceSetting < ApplicationRecord class NamespaceSetting < ApplicationRecord
include CascadingNamespaceSettingAttribute include CascadingNamespaceSettingAttribute
include Sanitizable
cascading_attr :delayed_project_removal cascading_attr :delayed_project_removal
...@@ -25,6 +26,8 @@ class NamespaceSetting < ApplicationRecord ...@@ -25,6 +26,8 @@ class NamespaceSetting < ApplicationRecord
self.primary_key = :namespace_id self.primary_key = :namespace_id
sanitizes! :default_branch_name
def prevent_sharing_groups_outside_hierarchy def prevent_sharing_groups_outside_hierarchy
return super if namespace.root? return super if namespace.root?
...@@ -34,11 +37,7 @@ class NamespaceSetting < ApplicationRecord ...@@ -34,11 +37,7 @@ class NamespaceSetting < ApplicationRecord
private private
def normalize_default_branch_name def normalize_default_branch_name
self.default_branch_name = if default_branch_name.blank? self.default_branch_name = default_branch_name.presence
nil
else
Sanitize.fragment(self.default_branch_name)
end
end end
def default_branch_name_content def default_branch_name_content
......
...@@ -3,6 +3,8 @@ ...@@ -3,6 +3,8 @@
require 'spec_helper' require 'spec_helper'
RSpec.describe NamespaceSetting, type: :model do RSpec.describe NamespaceSetting, type: :model do
it_behaves_like 'sanitizable', :namespace_settings, %i[default_branch_name]
# Relationships # Relationships
# #
describe "Associations" do describe "Associations" do
...@@ -41,14 +43,6 @@ RSpec.describe NamespaceSetting, type: :model do ...@@ -41,14 +43,6 @@ RSpec.describe NamespaceSetting, type: :model do
it_behaves_like "doesn't return an error" it_behaves_like "doesn't return an error"
end end
context "when it contains javascript tags" do
it "gets sanitized properly" do
namespace_settings.update!(default_branch_name: "hello<script>alert(1)</script>")
expect(namespace_settings.default_branch_name).to eq('hello')
end
end
end end
describe '#allow_mfa_for_group' do describe '#allow_mfa_for_group' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment