Fix that inline issue auto complete does not sanitize HTML tags (#33846).

Patch by Marius BALTEANU.


git-svn-id: http://svn.redmine.org/redmine/trunk@20827 e93f8b46-1217-0410-a6f0-8f06a7374b81

2 files changed, 22 insertions, 0 deletions

diff --git a/public/javascripts/application.js b/public/javascripts/application.js
index aa0c9ed0b..0467d97db 100644
--- a/public/javascripts/application.js
+++ b/public/javascripts/application.js
@@ -1,6 +1,12 @@
 /* Redmine - project management software
    Copyright (C) 2006-2020  Jean-Philippe Lang */
 
+function sanitizeHTML(string) {
+  var temp = document.createElement('span');
+  temp.textContent = string;
+  return temp.innerHTML;
+}
+
 function checkAll(id, checked) {
   $('#'+id).find('input[type=checkbox]:enabled').prop('checked', checked);
 }
@@ -1161,6 +1167,9 @@ function inlineAutoComplete(element) {
           selectTemplate: function (issue) {
             return '#' + issue.original.id;
           },
+          menuItemTemplate: function (issue) {
+            return sanitizeHTML(issue.original.label);
+          },
           noMatchTemplate: function () {
             return '<span style:"visibility: hidden;"></span>';
           }
diff --git a/test/system/inline_autocomplete_test.rb b/test/system/inline_autocomplete_test.rb
index f3c7daef6..b2f943d05 100644
--- a/test/system/inline_autocomplete_test.rb
+++ b/test/system/inline_autocomplete_test.rb
@@ -151,4 +151,17 @@ class InlineAutocompleteSystemTest < ApplicationSystemTestCase
     end
     assert_equal '[[Page_with_sections]] ', find('#issue_description').value
   end
+
+  def test_inline_autocomplete_for_issues_should_escape_html_elements
+    issue = Issue.generate!(subject: 'This issue has a <select> element', project_id: 1, tracker_id: 1)
+
+    log_user('jsmith', 'jsmith')
+    visit 'projects/1/issues/new'
+
+    fill_in 'Description', :with => '#This'
+
+    within('.tribute-container') do
+      assert page.has_text? "Bug ##{issue.id}: This issue has a <select> element"
+    end
+  end
 end