# Stored-XSS in merge requests

Unsanitized branch name injected into cite title attribute in MR sidebar yields stored XSS executing on merge request view despite CSP.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: yvvdwf
- Disclosed: 2021-07-13
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/977697
- Library page: https://bugbountylibrary.com/r/h1%3A977697
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:xss

**Target:** Merge request sidebar (_sidebar.html.haml) source_branch title attribute
**Root cause:** source_branch is interpolated into a cite title attribute and marked html_safe without escaping, so a branch name containing quotes breaks out of the attribute.
**Steps:**
1. Create project with README initialized.
2. Push a branch named `'><iframe/srcdoc='<script/src=/yvvdwf/data/-/jobs/552156057/artifacts/raw/alert.js></script>'></iframe>` via `git push origin master:"<payload>"`.
3. Open a merge request from that branch to master.
4. Viewing the MR page renders the payload and executes the script (alert) despite CSP.
**How found:** Code reading of _sidebar.html.haml line 170 revealed source_branch interpolated into a title attribute with html_safe and no escaping.
**Exploitation:** Attacker creates a branch with a crafted name and opens an MR; any user viewing the MR page executes attacker JS automatically, allowing API actions on the victim's behalf.
**Insight:** Branch names are attacker-controlled and often rendered in MR/commit UI; grep for html_safe interpolation of branch/ref names into HTML attributes, and note srcdoc iframes can bypass CSP script-src.