• Markus Koller's avatar
    Fix stored XSS vulnerability in Datadog settings form · e96534e0
    Markus Koller authored
    Previously we generated the URL for the link in the help text based on
    the user-submitted value in `datadog_site`, which caused a stored XSS
    vulnerability.
    
    This was accidentally fixed with the HTML-escaping we added in
    https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66391 while
    improving the help texts for this integration.
    
    But this still leaves some room for exploitation by changing the URL
    of a seemingly-trusted link, so instead we just hard-code the default
    link to the documentation on docs.datadoghq.com, and remove the custom
    link which goes directly to the user's API settings.
    
    Changelog: security
    e96534e0
datadog_spec.rb 5.65 KB