3 files changed, 32 insertions, 7 deletions
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 01bdf01ad22..785fb724132 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -3,6 +3,8 @@ require 'spec_helper'
 describe ApplicationHelper do
   include UploadHelpers
 
+  let(:gitlab_host) { "http://#{Gitlab.config.gitlab.host}" }
+
   describe 'current_controller?' do
     it 'returns true when controller matches argument' do
       stub_controller_name('foo')
@@ -56,8 +58,14 @@ describe ApplicationHelper do
   describe 'project_icon' do
     it 'returns an url for the avatar' do
       project = create(:empty_project, avatar: File.open(uploaded_image_temp_path))
+      avatar_url = "/uploads/project/avatar/#{project.id}/banana_sample.gif"
+
+      expect(helper.project_icon(project.full_path).to_s).
+        to eq "<img src=\"#{avatar_url}\" alt=\"Banana sample\" />"
+
+      allow(ActionController::Base).to receive(:asset_host).and_return(gitlab_host)
+      avatar_url = "#{gitlab_host}/uploads/project/avatar/#{project.id}/banana_sample.gif"
 
-      avatar_url = "http://#{Gitlab.config.gitlab.host}/uploads/project/avatar/#{project.id}/banana_sample.gif"
       expect(helper.project_icon(project.full_path).to_s).
         to eq "<img src=\"#{avatar_url}\" alt=\"Banana sample\" />"
     end
@@ -67,9 +75,8 @@ describe ApplicationHelper do
 
       allow_any_instance_of(Project).to receive(:avatar_in_git).and_return(true)
 
-      avatar_url = "http://#{Gitlab.config.gitlab.host}#{namespace_project_avatar_path(project.namespace, project)}"
-      expect(helper.project_icon(project.full_path).to_s).to match(
-        image_tag(avatar_url))
+      avatar_url = "#{gitlab_host}#{namespace_project_avatar_path(project.namespace, project)}"
+      expect(helper.project_icon(project.full_path).to_s).to match(image_tag(avatar_url))
     end
   end
 
@@ -77,8 +84,14 @@ describe ApplicationHelper do
     it 'returns an url for the avatar' do
       user = create(:user, avatar: File.open(uploaded_image_temp_path))
 
-      expect(helper.avatar_icon(user.email).to_s).
-        to match("/uploads/user/avatar/#{user.id}/banana_sample.gif")
+      avatar_url = "/uploads/user/avatar/#{user.id}/banana_sample.gif"
+
+      expect(helper.avatar_icon(user.email).to_s).to match(avatar_url)
+
+      allow(ActionController::Base).to receive(:asset_host).and_return(gitlab_host)
+      avatar_url = "#{gitlab_host}/uploads/user/avatar/#{user.id}/banana_sample.gif"
+
+      expect(helper.avatar_icon(user.email).to_s).to match(avatar_url)
     end
 
     it 'returns an url for the avatar with relative url' do
diff --git a/spec/helpers/avatars_helper_spec.rb b/spec/helpers/avatars_helper_spec.rb
index 581726c1d0e..6157abfe339 100644
--- a/spec/helpers/avatars_helper_spec.rb
+++ b/spec/helpers/avatars_helper_spec.rb
@@ -15,7 +15,7 @@ describe AvatarsHelper do
     end
 
     it "contains the user's avatar image" do
-      is_expected.to include(CGI.escapeHTML(user.avatar_url(16)))
+      is_expected.to include(CGI.escapeHTML(user.avatar_url(size: 16)))
     end
   end
 end
diff --git a/spec/helpers/submodule_helper_spec.rb b/spec/helpers/submodule_helper_spec.rb
index 345bc33a67b..9da33792659 100644
--- a/spec/helpers/submodule_helper_spec.rb
+++ b/spec/helpers/submodule_helper_spec.rb
@@ -109,6 +109,18 @@ describe SubmoduleHelper do
     end
 
     context 'submodule on unsupported' do
+      it 'sanitizes unsupported protocols' do
+        stub_url('javascript:alert("XSS");')
+
+        expect(helper.submodule_links(submodule_item)).to eq([nil, nil])
+      end
+
+      it 'sanitizes unsupported protocols disguised as a repository URL' do
+        stub_url('javascript:alert("XSS");foo/bar.git')
+
+        expect(helper.submodule_links(submodule_item)).to eq([nil, nil])
+      end
+
       it 'returns original' do
         stub_url('http://mygitserver.com/gitlab-org/gitlab-ce')
         expect(submodule_links(submodule_item)).to eq([repo.submodule_url_for, nil])