From aca5fb4e1ba5f994578bbeab05fe60bd0d964463 Mon Sep 17 00:00:00 2001 From: Thiago Presa Date: Tue, 23 Oct 2018 02:21:32 +0000 Subject: Merge branch 'security-11-4-51527-xss-in-mr-source-branch' into 'security-11-4' [11.4] Fix XSS in MR source branch name See merge request gitlab/gitlabhq!2550 --- app/presenters/merge_request_presenter.rb | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) (limited to 'app/presenters') diff --git a/app/presenters/merge_request_presenter.rb b/app/presenters/merge_request_presenter.rb index 3f565b826dd..1db6c9eff36 100644 --- a/app/presenters/merge_request_presenter.rb +++ b/app/presenters/merge_request_presenter.rb @@ -108,16 +108,10 @@ class MergeRequestPresenter < Gitlab::View::Presenter::Delegated namespace = source_project_namespace branch = source_branch - if source_branch_exists? - namespace = link_to(namespace, project_path(source_project)) - branch = link_to(branch, project_tree_path(source_project, source_branch)) - end + namespace_link = source_branch_exists? ? link_to(namespace, project_path(source_project)) : ERB::Util.html_escape(namespace) + branch_link = source_branch_exists? ? link_to(branch, project_tree_path(source_project, source_branch)) : ERB::Util.html_escape(branch) - if for_fork? - namespace + ":" + branch - else - branch - end + for_fork? ? "#{namespace_link}:#{branch_link}" : branch_link end def closing_issues_links -- cgit v1.2.1