Merge branch 'security-xss-bitbucket-import' into 'master'

Resolve "Cross-Site Scripting In BitbucketServer Import"

Closes #69

See merge request gitlab-org/security/gitlab!243

app/views/import/bitbucket_server/status.html.haml

@@ -57,7 +57,7 @@
         - @repos.each do |repo|
           %tr{ id: "repo_#{repo.project_key}___#{repo.slug}", data: { project: repo.project_key, repository: repo.slug } }
             %td
-              = link_to repo.browse_url, repo.browse_url, target: '_blank', rel: 'noopener noreferrer'
+              = sanitize(link_to(repo.browse_url, repo.browse_url, target: '_blank', rel: 'noopener noreferrer'), attributes: %w(href target rel))
             %td.import-target
               %fieldset.row
               .input-group
@@ -78,7 +78,7 @@
         - @incompatible_repos.each do |repo|
           %tr{ id: "repo_#{repo.project_key}___#{repo.slug}" }
             %td
-              = link_to repo.browse_url, repo.browse_url, target: '_blank', rel: 'noopener noreferrer'
+              = sanitize(link_to(repo.browse_url, repo.browse_url, target: '_blank', rel: 'noopener noreferrer'), attributes: %w(href target rel))
             %td.import-target
             %td.import-actions-job-status
               = label_tag 'Incompatible Project', nil, class: 'label badge-danger'

changelogs/unreleased/security-xss-bitbucket-import.yml

+---
+title: Sanitize bitbucket repo urls to mitigate XSS
+merge_request:
+author:
+type: security