Merge branch '11-5-security-stored-xss-via-katex' into 'security-11-5'

[11.5] Resolve "[Security] Stored XSS via KaTeX"

See merge request gitlab/gitlabhq!2756

(cherry picked from commit a4f28a482db2ccbbc2eae5ecda4a24b9993f7dfd)

429cae1b 11.5 backport of fix for XSS in KaTex Links
46ca66ed Merge branch 'security-11-5' of https://dev.gitlab.org/gitlab/gitlabhq into...

4 files changed, 35 insertions, 14 deletions

diff --git a/changelogs/unreleased/11-5-security-stored-xss-via-katex.yml b/changelogs/unreleased/11-5-security-stored-xss-via-katex.yml
new file mode 100644
index 00000000000..a71ae1123f2
--- /dev/null
+++ b/changelogs/unreleased/11-5-security-stored-xss-via-katex.yml
@@ -0,0 +1,5 @@
+---
+title: Fixed XSS content in KaTex links
+merge_request:
+author:
+type: security
diff --git a/package.json b/package.json
index 2d6479fea3f..8ccbccb8b79 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
     "js-cookie": "^2.1.3",
     "jszip": "^3.1.3",
     "jszip-utils": "^0.0.2",
-    "katex": "^0.9.0",
+    "katex": "^0.10.0",
     "marked": "^0.3.12",
     "mermaid": "^8.0.0-rc.8",
     "monaco-editor": "^0.14.3",
diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb
index 6a23d6b78ab..53abb5e3722 100644
--- a/spec/features/markdown/math_spec.rb
+++ b/spec/features/markdown/math_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe 'Math rendering', :js do
+  let!(:project)   { create(:project, :public) }
+
   it 'renders inline and display math correctly' do
     description = <<~MATH
       This math is inline $`a^2+b^2=c^2`$.
@@ -11,12 +13,26 @@ describe 'Math rendering', :js do
       ```
     MATH
 
-    project = create(:project, :public)
     issue = create(:issue, project: project, description: description)
 
     visit project_issue_path(project, issue)
 
-    expect(page).to have_selector('.katex .mord.mathit', text: 'b')
-    expect(page).to have_selector('.katex-display .mord.mathit', text: 'b')
+    expect(page).to have_selector('.katex .mord.mathdefault', text: 'b')
+    expect(page).to have_selector('.katex-display .mord.mathdefault', text: 'b')
+  end
+
+  it 'only renders non XSS links' do
+    description = <<~MATH
+      This link is valid $`\\href{javascript:alert('xss');}{xss}`$.
+
+      This link is valid $`\\href{https://gitlab.com}{Gitlab}`$.
+    MATH
+
+    issue = create(:issue, project: project, description: description)
+
+    visit project_issue_path(project, issue)
+
+    expect(page).to have_selector('.katex-error', text: "\href{javascript:alert('xss');}{xss}")
+    expect(page).to have_selector('.katex-html a', text: 'Gitlab')
   end
 end
diff --git a/yarn.lock b/yarn.lock
index 38e0f9d6201..b52dc1d8091 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1874,6 +1874,11 @@ commander@2, commander@^2.18.0:
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.18.0.tgz#2bf063ddee7c7891176981a2cc798e5754bc6970"
   integrity sha512-6CYPa+JP2ftfRU2qkDK+UTVeQYosOg/2GbcjIcKPHfinyOLPVGXu/ovN86RP49Re5ndJK1N0kuiidFFuepc4ZQ==
 
+commander@^2.16.0:
+  version "2.19.0"
+  resolved "https://registry.yarnpkg.com/commander/-/commander-2.19.0.tgz#f6198aa84e5b83c46054b94ddedbfed5ee9ff12a"
+  integrity sha512-6tvAOO+D6OENvRAh524Dh9jcfKTYDQAqvqezbCW82xj5X0pSrcpxtvRKHLG0yBY6SD7PSDrJaj+0AiOcKVd1Xg==
+
 commander@~2.13.0:
   version "2.13.0"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.13.0.tgz#6964bca67685df7c1f1430c584f07d7597885b9c"
@@ -4987,12 +4992,12 @@ karma@^3.0.0:
     tmp "0.0.33"
     useragent "2.2.1"
 
-katex@^0.9.0:
-  version "0.9.0"
-  resolved "https://registry.yarnpkg.com/katex/-/katex-0.9.0.tgz#26a7d082c21d53725422d2d71da9b2d8455fbd4a"
-  integrity sha512-lp3x90LT1tDZBW2tjLheJ98wmRMRjUHwk4QpaswT9bhqoQZ+XA4cPcjcQBxgOQNwaOSt6ZeL/a6GKQ1of3LFxQ==
+katex@^0.10.0:
+  version "0.10.0"
+  resolved "https://registry.yarnpkg.com/katex/-/katex-0.10.0.tgz#da562e5d0d5cc3aa602e27af8a9b8710bfbce765"
+  integrity sha512-/WRvx+L1eVBrLwX7QzKU1dQuaGnE7E8hDvx3VWfZh9HbMiCfsKWJNnYZ0S8ZMDAfAyDSofdyXIrH/hujF1fYXg==
   dependencies:
-    match-at "^0.1.1"
+    commander "^2.16.0"
 
 keyv@3.0.0:
   version "3.0.0"
@@ -5278,11 +5283,6 @@ marked@^0.3.12:
   resolved "https://registry.yarnpkg.com/marked/-/marked-0.3.12.tgz#7cf25ff2252632f3fe2406bde258e94eee927519"
   integrity sha512-k4NaW+vS7ytQn6MgJn3fYpQt20/mOgYM5Ft9BYMfQJDz2QT6yEeS9XJ8k2Nw8JTeWK/znPPW2n3UJGzyYEiMoA==
 
-match-at@^0.1.1:
-  version "0.1.1"
-  resolved "https://registry.yarnpkg.com/match-at/-/match-at-0.1.1.tgz#25d040d291777704d5e6556bbb79230ec2de0540"
-  integrity sha512-h4Yd392z9mST+dzc+yjuybOGFNOZjmXIPKWjxBd1Bb23r4SmDOsk2NYCU2BMUBGbSpZqwVsZYNq26QS3xfaT3Q==
-
 md5.js@^1.3.4:
   version "1.3.4"
   resolved "https://registry.yarnpkg.com/md5.js/-/md5.js-1.3.4.tgz#e9bdbde94a20a5ac18b04340fc5764d5b09d901d"