Merge branch 'security-xss-epic-milestone' into 'master'

Sanitize XSS in Epic milestone due date

See merge request gitlab-org/security/gitlab!1142

ee/app/assets/javascripts/epic/utils/epic_utils.js

@@ -6,6 +6,7 @@ import { __, s__, sprintf } from '~/locale';
 import createGqClient, { fetchPolicies } from '~/lib/graphql';
 import { parseBoolean } from '~/lib/utils/common_utils';
 import { dateInWords, parsePikadayDate } from '~/lib/utils/datetime_utility';
+import { sanitize } from '~/lib/dompurify';
 
 import { dateTypes } from '../constants';
 
@@ -54,8 +55,9 @@ const getDateFromMilestonesTooltip = ({
   dueDateSourcingMilestoneDates,
   dueDateTimeFromMilestones,
 }) => {
-  const dateSourcingMilestoneTitle =
-    dateType === dateTypes.start ? startDateSourcingMilestoneTitle : dueDateSourcingMilestoneTitle;
+  const dateSourcingMilestoneTitle = sanitize(
+    dateType === dateTypes.start ? startDateSourcingMilestoneTitle : dueDateSourcingMilestoneTitle,
+  );
   const sourcingMilestoneDates =
     dateType === dateTypes.start ? startDateSourcingMilestoneDates : dueDateSourcingMilestoneDates;
 

ee/changelogs/unreleased/security-xss-epic-milestone.yml

+---
+title: Sanitize XSS in Epic milestone due date
+merge_request:
+author:
+type: security

ee/spec/frontend/epic/utils/epic_utils_spec.js

@@ -57,4 +57,23 @@ describe('epicUtils', () => {
       expect(Cookies.get('collapsed_gutter')).toBe(`${collapsedGutterVal}`); // Cookie value will always be string
     });
   });
+
+  describe('getDateFromMilestonesTooltip', () => {
+    it('Sanitizes html in milestone title', () => {
+      const tooltipText = epicUtils.getDateFromMilestonesTooltip({
+        dateType: 'start',
+        startDateSourcingMilestoneTitle:
+          '<svg width="100"><use xlink:href="/h5bp/html5-boilerplate/-/raw/master/demo.svg#x" /></svg>',
+        startDateSourcingMilestoneDates: {
+          startDate: '2020-12-23',
+          dueDate: '2021-01-28',
+        },
+        startDateTimeFromMilestones: '2020-12-22T18:30:00.000Z',
+        dueDateTimeFromMilestones: '2021-01-27T18:30:00.000Z',
+      });
+
+      const sanitizedTitle = '<svg width="100"><use></use></svg>';
+      expect(tooltipText.startsWith(sanitizedTitle)).toBe(true);
+    });
+  });
 });