BigW Consortium Gitlab
Remove persistent XSS vulnerability in `commit_person_link` helper Because we were incorrectly supplying the tooltip title as `data-original-title` (which Bootstrap's Tooltip JS automatically applies based on the `title` attribute; we should never be setting it directly), the value was being passed through as-is. Instead, we should be supplying the normal `title` attribute and letting Rails escape the value, which also negates the need for us to call `sanitize` on it. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126 See merge request !1948
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
config | Loading commit data... | |
controllers | Loading commit data... | |
factories | Loading commit data... | |
features | Loading commit data... | |
finders | Loading commit data... | |
fixtures | Loading commit data... | |
helpers | Loading commit data... | |
initializers | Loading commit data... | |
javascripts | Loading commit data... | |
lib | Loading commit data... | |
mailers | Loading commit data... | |
models | Loading commit data... | |
requests | Loading commit data... | |
routing | Loading commit data... | |
services | Loading commit data... | |
support | Loading commit data... | |
tasks/gitlab | Loading commit data... | |
views | Loading commit data... | |
workers | Loading commit data... | |
factories_spec.rb | Loading commit data... | |
rails_helper.rb | Loading commit data... | |
spec_helper.rb | Loading commit data... | |
teaspoon_env.rb | Loading commit data... |