Fix character escaping in Resolved By tooltips
What does this MR do?
For #299327 (closed)
This MR passes the escapeParamaters
boolean flag to sprintf
. It passes false
which stops unnecessary escaping from being run on the tooltip content.
Since the title
attribute content is provided to the Bootstrap Tooltip component as the same attribute, and Bootstrap Vue only allows text, there's no chance of an XSS: any HTML is outputted directly to the screen as text.
The evidence of this is... this bug! The escaped character is valid HTML, but it's displayed directly as text.
Screenshots (strongly suggested)
Before | After |
---|---|
Does this MR meet the acceptance criteria?
Conformity
-
📋 Does this MR need a changelog?-
I have included a changelog entry. -
I have not included a changelog entry because _____.
-
- [-] Documentation (if required)
-
Code review guidelines -
Merge request performance guidelines -
Style guides - [-] Database guides
- [-] Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers - [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
- [-] Label as security and @ mention
@gitlab-com/gl-security/appsec
- [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
- [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Thomas Randolph