Skip to content
Snippets Groups Projects
New issue look: Off

Diff content in an MR comments should not end in the MR page source code

    • Open Issue created by username-removed-550912 @clorichel

    Summary

    Commenting commits let a diff comment appear on related merge requests, which is great :thumbsup:.

    But, it happens that the diff code ends up in the merge request page source code, getting HTML parsed by the browser :upside_down:

    Steps to reproduce

    I wish I could reproduce! We got weird frontend on large merge requests, and/or merge requests containing many comments on related commits, more issues to come...

    Expected behavior

    There should be no way for a diff content to get HTML parsed by the browser!

    Actual behavior

    Some HTML tags get parsed by the browser.

    Relevant logs and/or screenshots

    This is how it comes on the merge request page:

    mr-comment

    Note that I was asked to hide the full url in the browser console which is something like http://theGitLabInstanceUrl.ext/groupName/projectName/img/admin/ok.gif.

    This is how the merge request page html source code looks like:

    mr-sourcehtml

    And this is how it appears on the commit page, which is exactly what is expected on the merge request page:

    commit

    To ease reproducing, here is the original code on this line $this->_html .= '<div class="conf confirm"><img src="../img/admin/ok.gif" />' which is in a .php file. Side-note: yes, it is ugly to write HTML in a PHP variable... There are some cases it still happens in 2016 and I must say I'm sick of it :nerd:

    Output of checks

    Results of GitLab application Check

    # sudo gitlab-rake gitlab:check SANITIZE=true
Checking GitLab Shell ...

GitLab Shell version >= 4.0.0 ? ... OK (4.0.0)
Repo base directory exists?
default... yes
Repo storage directories are symlinks?
default... no
Repo paths owned by git:git?
default... yes
Repo paths access is drwxrws---?
default... yes
hooks directories in repos are links: ...
18/1 ... ok
49/2 ... ok

... a very long list of "ok" or "repository is empty", I promise! ...

86/179 ... repository is empty
86/180 ... repository is empty
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Check GitLab API access: OK
Access to /var/opt/gitlab/.ssh/authorized_keys: OK
Send ping to redis server: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Sidekiq ...

Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking Reply by email ...

Reply by email is disabled in config/gitlab.yml

Checking Reply by email ... Finished

Checking LDAP ...

LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished

Checking GitLab ...

Git configured with autocrlf=input? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config outdated? ... no
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory setup correctly? ... no
  Try fixing it:
  sudo chown -R git /var/opt/gitlab/gitlab-rails/uploads
  sudo find /var/opt/gitlab/gitlab-rails/uploads -type f -exec chmod 0644 {} \;
  sudo find /var/opt/gitlab/gitlab-rails/uploads -type d -not -path /var/opt/gitlab/gitlab-rails/uploads -exec chmod 0700 {} \;
  For more information see:
  doc/install/installation.md in section "GitLab"
  Please fix the error above and rerun the checks.
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
projects have namespace: ...
18/1 ... yes
49/2 ... yes

... a very long list of "yes", I promise! ...

86/179 ... yes
86/180 ... yes
Redis version >= 2.8.0? ... yes
Ruby version >= 2.1.0 ? ... yes (2.3.1)
Your git bin path is "/opt/gitlab/embedded/bin/git"
Git version >= 2.7.3 ? ... yes (2.7.4)
Active users: 61

Checking GitLab ... Finished

    Results of GitLab environment info

    sudo gitlab-rake gitlab:env:info

System information
System:		Debian 8.6
Current User:	git
Using RVM:	no
Ruby Version:	2.3.1p112
Gem Version:	2.6.6
Bundler Version:1.13.6
Rake Version:	10.5.0
Sidekiq Version:4.2.1

GitLab information
Version:	8.14.1
Revision:	e45bf3d
Directory:	/opt/gitlab/embedded/service/gitlab-rails
DB Adapter:	postgresql
URL:		http://theGitLabInstanceUrl.ext
HTTP Clone URL:	http://theGitLabInstanceUrl.ext/some-group/some-project.git
SSH Clone URL:	git@theGitLabInstanceUrl.ext:some-group/some-project.git
Using LDAP:	no
Using Omniauth:	no

GitLab Shell
Version:	4.0.0
Repository storage paths:
- default: 	/var/opt/gitlab/git-data/repositories
Hooks:		/opt/gitlab/embedded/service/gitlab-shell/hooks/
Git:		/opt/gitlab/embedded/bin/git

    Possible fixes

    I'm afraid I come with none.

    Designs

      Child items ...

      2. Activity

      Please register or sign in to reply