Merge branch 'security-mr-approvers-xss' into 'master'

[master] Fixed XSS in merge request approvers

Closes #353

See merge request gitlab/gitlab-ee!662

ee/app/assets/javascripts/approvers_select.js

@@ -114,7 +114,7 @@ export default class ApproversSelect {
   }
 
   static formatSelection(group) {
-    return group.full_name || group.name;
+    return _.escape(group.full_name || group.name);
   }
 
   static formatResult({

ee/changelogs/unreleased/security-mr-approvers-xss.yml

+---
+title: Fixes XSS with merge request approvers selection
+merge_request:
+author:
+type: security

ee/spec/javascripts/approvers_select_spec.js

@@ -59,4 +59,22 @@ describe('ApproversSelect', () => {
       expect(output).not.toContain('<script>alert("testing")</script>');
     });
   });
+
+  describe('formatSelection', () => {
+    it('escapes full name', () => {
+      expect(
+        ApproversSelect.formatSelection({
+          full_name: '<script>alert("testing")</script>',
+        }),
+      ).not.toBe('<script>alert("testing")</script>');
+    });
+
+    it('escapes name', () => {
+      expect(
+        ApproversSelect.formatSelection({
+          name: '<script>alert("testing")</script>',
+        }),
+      ).not.toBe('<script>alert("testing")</script>');
+    });
+  });
 });