# CSP-bypass XSS in project settings page

Deploy key title rendered unsanitized into jQuery dropdown HTML, executing script despite strict-dynamic CSP, enabling XSS against project maintainers.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: yvvdwf
- Disclosed: 2022-11-16
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1588732
- Library page: https://bugbountylibrary.com/r/h1%3A1588732
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:chained technique:source-review vuln:xss

**Target:** GitLab project settings repository page deploy keys / protected branches dropdown
**Root cause:** deployKeyRowHtml interpolates key.title directly into an HTML template string without escaping, and the result is appended via jQuery $('<ul>').append(html), which executes <script> tags.
**Steps:**
1. Go to project Settings/Repository, add a Deploy key with Title `test <script>alert(document.domain)</script>` and any valid SSH public key, check write permissions, click Add key.
2. Expand Protected branches (or load `/-/settings/repository#js-protected-branches-settings`).
3. Open the 'Allowed to push' dropdown; the payload executes despite CSP strict-dynamic.
**How found:** Code review of access_dropdown.js deployKeyRowHtml found unescaped key.title interpolation, then traced rendering through gl_dropdown.js renderMenu using jQuery append, noting jQuery executes script tags even under strict-dynamic CSP.
**Exploitation:** Attacker (or any user able to add a deploy key, or a maintainer added without consent) stores HTML in the deploy key title; when a victim maintainer opens the protected branches dropdown, jQuery renders the title and executes the script, allowing arbitrary authenticated API requests on the victim's behalf.
**Insight:** When auditing CSP strict-dynamic deployments, look for jQuery $().append()/html() sinks fed by template strings: strict-dynamic does not stop script execution via jQuery's HTML parsing, so any unescaped interpolation into such sinks is a CSP bypass.