diff --git a/app/helpers/labels_helper.rb b/app/helpers/labels_helper.rb
index 2ed016beea49db4e5bbc90ba12a4c9f32e762bf9..c5a3507637e38774f893202febf71a51cd1006ce 100644
--- a/app/helpers/labels_helper.rb
+++ b/app/helpers/labels_helper.rb
@@ -71,7 +71,7 @@ module LabelsHelper
end
def label_tooltip_title(label)
- label.description
+ Sanitize.clean(label.description)
end
def suggested_colors
diff --git a/app/models/label.rb b/app/models/label.rb
index d9455b362420ec49adbbf2860f26f32f7fcf4407..dc9f0a3d1a9d87588dfaec874048cec24db3984f 100644
--- a/app/models/label.rb
+++ b/app/models/label.rb
@@ -199,7 +199,11 @@ class Label < ApplicationRecord
end
def title=(value)
- write_attribute(:title, sanitize_title(value)) if value.present?
+ write_attribute(:title, sanitize_value(value)) if value.present?
+ end
+
+ def description=(value)
+ write_attribute(:description, sanitize_value(value)) if value.present?
end
##
@@ -260,7 +264,7 @@ class Label < ApplicationRecord
end
end
- def sanitize_title(value)
+ def sanitize_value(value)
CGI.unescapeHTML(Sanitize.clean(value.to_s))
end
diff --git a/changelogs/unreleased/security-fix-html-injection-for-label-description-ce-master.yml b/changelogs/unreleased/security-fix-html-injection-for-label-description-ce-master.yml
new file mode 100644
index 0000000000000000000000000000000000000000..07124ac399bc206c6e5b3141d5c7748660f95e74
--- /dev/null
+++ b/changelogs/unreleased/security-fix-html-injection-for-label-description-ce-master.yml
@@ -0,0 +1,5 @@
+---
+title: Fix HTML injection for label description
+merge_request:
+author:
+type: security
diff --git a/spec/helpers/labels_helper_spec.rb b/spec/helpers/labels_helper_spec.rb
index 4f1cab38f342177292bc2ff18f10c350a0774b45..1d57aaa0da5a21350d95a1d9bad982ae403934f6 100644
--- a/spec/helpers/labels_helper_spec.rb
+++ b/spec/helpers/labels_helper_spec.rb
@@ -278,4 +278,14 @@ describe LabelsHelper do
it { is_expected.to eq('Subscribe at group level') }
end
end
+
+ describe '#label_tooltip_title' do
+ let(:html) { '
This is an image' }
+ let(:label_with_html_content) { create(:label, title: 'test', description: html) }
+
+ it 'removes HTML' do
+ tooltip = label_tooltip_title(label_with_html_content)
+ expect(tooltip).to eq('This is an image')
+ end
+ end
end
diff --git a/spec/models/label_spec.rb b/spec/models/label_spec.rb
index c2e2298823e3810930bdfaae576daec20541cb53..baf2cfeab0c8f70af1e674f850a8755e119e8b37 100644
--- a/spec/models/label_spec.rb
+++ b/spec/models/label_spec.rb
@@ -84,6 +84,13 @@ describe Label do
end
end
+ describe '#description' do
+ it 'sanitizes description' do
+ label = described_class.new(description: 'foo & bar?')
+ expect(label.description).to eq('foo & bar?')
+ end
+ end
+
describe 'priorization' do
subject(:label) { create(:label) }