# Stored XSS in merge request creation page through payload in approval rule name

Approval rule name stored unsanitized and rendered in the merge request Reviewers dropdown, yielding stored XSS that bypasses GitLab.com CSP via iframe srcdoc.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: joaxcar
- Disclosed: 2022-03-31
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1342009
- Library page: https://bugbountylibrary.com/r/h1%3A1342009
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:rest technique:chained vuln:xss

**Target:** Merge request creation page Reviewers dropdown / approval rule name
**Root cause:** The approval rule name is injected into the approver user info in the Reviewers dropdown without sanitization, allowing HTML/JS injection.
**Steps:**
1. Create attacker (premium) and victim accounts.
2. As attacker, create project and open Settings > Merge request approvals.
3. Add approval rule with name `<iframe/srcdoc='<script/src=/joaxcar_group/first/-/jobs/1415515489/artifacts/raw/data/alert.js></script>'></iframe>` and select attacker as approver.
4. Invite victim as Developer.
5. As victim, create a branch and click 'Create merge request'.
6. Open the Reviewers dropdown; payload fires.
**How found:** Researcher tested injecting HTML/JS into approval rule names and observed the name rendered in the Reviewers dropdown; noted it did not fire on MR edit, and crafted an iframe srcdoc payload to bypass GitLab.com CSP.
**Exploitation:** Attacker with premium features plants a malicious approval rule name, invites a victim to the project, and the payload executes in the victim's session when they open the Reviewers dropdown on MR creation, enabling data theft and access token exfiltration.
**Escalation:** CSP bypass via iframe srcdoc loading an external script from a GitLab job artifact URL, granting full JS execution.
**Insight:** Feature-gated fields (premium approval rules) can still be weaponized against non-premium victims invited into the project; test where rule metadata is re-rendered in other users' UI, and use iframe srcdoc with a same-origin artifact script to defeat CSP.