Skip to content

Fix whitespace parameter handling

David O'Regan requested to merge 378216-wiki-xss into master

What does this MR do and why?

A small MVC for Cross-site scripting in wiki changes page affec... (#378216 - closed).

Screenshots or screen recordings

N/A

How to set up and validate locally

  1. Log in to the project locally.
  2. Create a project.
  3. From the sidebar, click Wiki.
  4. Click Create your first page
  5. Fill in the contents.
  6. Click Create page
  7. Open https://localhost:3000/USERNAME/PROJECT_NAME/-/wikis/home/diff?protocol=javascript&host=%250dalert(document.domain)//
  8. Click Hide whitespace changes
  9. Confirm that alert(document.domain) has not been executed.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #378216 (closed)

Merge request reports