deac/gitlabhq
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Prevent xss attack over group name. Added regex validation for group and team name

Browse source
This commit is contained in:
Dmitriy Zaporozhets 2013-02-18 09:28:18 +02:00
parent cfdf94fc27
commit 020078663e
5 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
app/helpers/application_helper.rb
View file

@ -73,8 +73,8 @@ module ApplicationHelper
def search_autocomplete_source
projects = current_user.authorized_projects.map { |p| { label: "project: #{p.name_with_namespace}", url: project_path(p) } }
groups = current_user.authorized_groups.map { |group| { label: "group: #{group.name}", url: group_path(group) } }
teams = current_user.authorized_teams.map { |team| { label: "team: #{team.name}", url: team_path(team) } }
groups = current_user.authorized_groups.map { |group| { label: "group: #{simple_sanitize(group.name)}", url: group_path(group) } }
teams = current_user.authorized_teams.map { |team| { label: "team: #{simple_sanitize(team.name)}", url: team_path(team) } }
default_nav = [
{ label: "My Profile", url: profile_path },
@ -159,8 +159,13 @@ module ApplicationHelper
alt: "Sign in with #{provider.to_s.titleize}")
end
def simple_sanitize str
sanitize(str, tags: %w(a span))
end
def image_url(source)
root_url + path_to_image(source)
end
alias_method :url_to_image, :image_url
end

2
app/helpers/projects_helper.rb
View file

@ -56,7 +56,7 @@ module ProjectsHelper
def project_title project
if project.group
content_tag :span do
link_to(project.group.name, group_path(project.group)) + " / " + project.name
link_to(simple_sanitize(project.group.name), group_path(project.group)) + " / " + project.name
end
else
project.name