Skip to content
代码片段 群组 项目
未验证 提交 76db50d6 编辑于 作者: Phil Hughes's avatar Phil Hughes
浏览文件

Fixes gl-emoji's not rendering inside of issue descriptions

The gl-emoji tag gets sanitized out of the issue description
which means that fallback emojis won't work.
上级 342186c7
No related branches found
No related tags found
2 合并请求!106Draft: This MR is specified for doc sync check,!105Draft:This MR is specified for docsynccheck, will not be merged
...@@ -123,6 +123,7 @@ export default { ...@@ -123,6 +123,7 @@ export default {
} }
}, },
}, },
safeHtmlConfig: { ADD_TAGS: ['gl-emoji'] },
}; };
</script> </script>
...@@ -136,7 +137,7 @@ export default { ...@@ -136,7 +137,7 @@ export default {
> >
<div <div
ref="gfm-content" ref="gfm-content"
v-safe-html="descriptionHtml" v-safe-html:[$options.safeHtmlConfig]="descriptionHtml"
:class="{ :class="{
'issue-realtime-pre-pulse': preAnimation, 'issue-realtime-pre-pulse': preAnimation,
'issue-realtime-trigger-pulse': pulseAnimation, 'issue-realtime-trigger-pulse': pulseAnimation,
......
...@@ -3,7 +3,7 @@ import { getBaseURL, relativePathToAbsolute } from '~/lib/utils/url_utility'; ...@@ -3,7 +3,7 @@ import { getBaseURL, relativePathToAbsolute } from '~/lib/utils/url_utility';
const defaultConfig = { const defaultConfig = {
// Safely allow SVG <use> tags // Safely allow SVG <use> tags
ADD_TAGS: ['use'], ADD_TAGS: ['use', 'gl-emoji'],
// Prevent possible XSS attacks with data-* attributes used by @rails/ujs // Prevent possible XSS attacks with data-* attributes used by @rails/ujs
// See https://gitlab.com/gitlab-org/gitlab-ui/-/issues/1421 // See https://gitlab.com/gitlab-org/gitlab-ui/-/issues/1421
FORBID_ATTR: ['data-remote', 'data-url', 'data-type', 'data-method'], FORBID_ATTR: ['data-remote', 'data-url', 'data-type', 'data-method'],
......
...@@ -32,6 +32,21 @@ ...@@ -32,6 +32,21 @@
end end
end end
context 'when issue description has emojis' do
let(:issue) { create(:issue, project: project, author: user, description: 'hello world :100:') }
before do
sign_in(user)
visit project_issue_path(project, issue)
end
it 'renders gl-emoji tag' do
page.within('.description') do
expect(page).to have_selector('gl-emoji', count: 1)
end
end
end
context 'when issue description has xss snippet' do context 'when issue description has xss snippet' do
before do before do
issue.update!(description: '![xss" onload=alert(1);//](a)') issue.update!(description: '![xss" onload=alert(1);//](a)')
......
...@@ -65,6 +65,10 @@ describe('~/lib/dompurify', () => { ...@@ -65,6 +65,10 @@ describe('~/lib/dompurify', () => {
expect(sanitize(htmlXlink)).toBe(htmlXlink); expect(sanitize(htmlXlink)).toBe(htmlXlink);
}); });
it("doesn't sanitize gl-emoji", () => {
expect(sanitize('<p><gl-emoji>💯</gl-emoji></p>')).toBe('<p><gl-emoji>💯</gl-emoji></p>');
});
describe.each` describe.each`
type | gon type | gon
${'root'} | ${rootGon} ${'root'} | ${rootGon}
......
0% 加载中 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册