# Stored-XSS on wiki pages

Git commit author email flows unsanitized into a mailto: href marked html_safe on GitLab wiki pages, letting a crafted email inject attributes and run stored XSS.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: yvvdwf
- Disclosed: 2021-07-13
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1087061
- Library page: https://bugbountylibrary.com/r/h1%3A1087061
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:misconfiguration vuln:xss

**Target:** Wiki page version author link (app/views/shared/wikis/show.html.haml)
**Root cause:** author_url builds `mailto:#{author_email}` from the git commit author email and the view interpolates it into an `<a href='...'>` string marked `.html_safe`, so attacker-controlled email breaks out of the href attribute.
**Steps:**
1. Clone wiki repo: `git clone git@gl.local:root/test.wiki.git`
2. Set `.git/config` [user] email to `#' style=animation-name:blinking-dot onanimationstart=alert(document.domain) other`
3. Modify a wiki page: `echo "Hi" >> home.md`, commit and push
4. Visit `http://gl.local/hi/test/-/wikis/home`; alert fires
**How found:** Code reading of a recent change in show.html.haml where author_url is marked html_safe; traced author_url to wiki_page_version.rb where it falls back to `mailto:#{author_email}` from the commit, an attacker-controlled value.
**Exploitation:** Attacker with push access to a wiki repo sets a malicious author email, pushes a commit; when any victim views the wiki page history link, the injected onanimationstart handler executes in their session.
**Insight:** When a URL builder falls back to embedding raw user data (e.g. mailto: with an email), check whether the template marks the whole string html_safe — attribute-context injection via single quotes bypasses href sanitization.