kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'import-symlinks-9-3' into 'security-9-3'

Browse source 
Fix file disclosure via hidden symlinks using the project import (9.3)

See merge request !2164
This commit is contained in:
James Edwards-Jones 2017-08-08 21:18:02 +00:00
parent 4c7ada21c0
commit 334915d508
3 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
changelogs/unreleased/fix-import-symbolink-links.yml Normal file
View file

@ -0,0 +1,4 @@
---
title: Remove hidden symlinks from project import files
merge_request:
author:

6
lib/gitlab/import_export/file_importer.rb
View file

@ -47,12 +47,16 @@ module Gitlab
end
def remove_symlinks!
Dir["#{@shared.export_path}/**/*"].each do |path|
extracted_files.each do |path|
FileUtils.rm(path) if File.lstat(path).symlink?
end
true
end
def extracted_files
Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| f =~ /.*\/\.{1,2}$/ }
end
end
end
end

5
spec/lib/gitlab/import_export/file_importer_spec.rb
View file

@ -5,6 +5,7 @@ describe Gitlab::ImportExport::FileImporter do
let(:export_path) { "#{Dir.tmpdir}/file_importer_spec" }
let(:valid_file) { "#{shared.export_path}/valid.json" }
let(:symlink_file) { "#{shared.export_path}/invalid.json" }
let(:hidden_symlink_file) { "#{shared.export_path}/.hidden" }
let(:subfolder_symlink_file) { "#{shared.export_path}/subfolder/invalid.json" }
before do
@ -25,6 +26,10 @@ describe Gitlab::ImportExport::FileImporter do
expect(File.exist?(symlink_file)).to be false
end
it 'removes hidden symlinks in root folder' do
expect(File.exist?(hidden_symlink_file)).to be false
end
it 'removes symlinks in subfolders' do
expect(File.exist?(subfolder_symlink_file)).to be false
end