lib/banzai · 5a5e03b5aa01c837ae4e1fcc02f7f9def960e98b · Forest Godfrey / gitlab-ce · GitLab

BigW Consortium Gitlab

History Find file

Merge branch 'markdown-xss-fix-option-2.1' into 'security' · a14ee68f

authored Nov 07, 2016

Fix for HackerOne XSS vulnerability in markdown

This is an updated blacklist patch to fix https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2007. No text is removed. Dangerous schemes/protocols and invalid URIs are left intact but not linked.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23153

See merge request !2015
Signed-off-by: Rémy Coutable <remy@rymai.me>

a14ee68f

Name	Last commit	Last update
..
filter		Loading commit data...
pipeline		Loading commit data...
reference_parser		Loading commit data...
cross_project_reference.rb		Loading commit data...
filter.rb		Loading commit data...
filter_array.rb		Loading commit data...
note_renderer.rb		Loading commit data...
object_renderer.rb		Loading commit data...
pipeline.rb		Loading commit data...
querying.rb		Loading commit data...
redactor.rb		Loading commit data...
reference_extractor.rb		Loading commit data...
reference_parser.rb		Loading commit data...
renderer.rb		Loading commit data...