From 4f23bb9caaf626dffad1ebaf875b75921dbc7307 Mon Sep 17 00:00:00 2001
From: Kushal Pandya <kushal@gitlab.com>
Date: Fri, 19 Oct 2018 13:47:56 +0530
Subject: Escape issue title while template rendering to prevent XSS

---
 app/assets/javascripts/gfm_auto_complete.js | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/app/assets/javascripts/gfm_auto_complete.js b/app/assets/javascripts/gfm_auto_complete.js
index 95636a9ccdd..7dd0efd622d 100644
--- a/app/assets/javascripts/gfm_auto_complete.js
+++ b/app/assets/javascripts/gfm_auto_complete.js
@@ -201,7 +201,7 @@ class GfmAutoComplete {
       displayTpl(value) {
         let tmpl = GfmAutoComplete.Loading.template;
         if (value.title != null) {
-          tmpl = GfmAutoComplete.Issues.template;
+          tmpl = GfmAutoComplete.Issues.templateFunction(value.id, value.title);
         }
         return tmpl;
       },
@@ -267,7 +267,7 @@ class GfmAutoComplete {
       displayTpl(value) {
         let tmpl = GfmAutoComplete.Loading.template;
         if (value.title != null) {
-          tmpl = GfmAutoComplete.Issues.template;
+          tmpl = GfmAutoComplete.Issues.templateFunction(value.id, value.title);
         }
         return tmpl;
       },
@@ -370,7 +370,7 @@ class GfmAutoComplete {
       displayTpl(value) {
         let tmpl = GfmAutoComplete.Loading.template;
         if (value.title != null) {
-          tmpl = GfmAutoComplete.Issues.template;
+          tmpl = GfmAutoComplete.Issues.templateFunction(value.id, value.title);
         }
         return tmpl;
       },
@@ -557,8 +557,9 @@ GfmAutoComplete.Labels = {
 };
 // Issues, MergeRequests and Snippets
 GfmAutoComplete.Issues = {
-  // eslint-disable-next-line no-template-curly-in-string
-  template: '<li><small>${id}</small> ${title}</li>',
+  templateFunction(id, title) {
+    return `<li><small>${id}</small> ${_.escape(title)}</li>`;
+  },
 };
 // Milestones
 GfmAutoComplete.Milestones = {
-- 
cgit v1.2.1