kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'shell-paths' into 'master'

Browse source 
More reasons why prefixing is good

Inspired by http://www.dwheeler.com/essays/filenames-in-shell.html

See merge request !1604
This commit is contained in:
Dmitriy Zaporozhets 2015-03-02 21:37:10 +00:00
commit 70e3409a50
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
doc/development/shell_commands.md
View file

@ -139,6 +139,11 @@ path = File.join(repo_path, user_input)
File.read(path)
```
If you have to use user input a relative path, prefix `./` to the path.
Prefixing user-supplied paths also offers extra protection against paths
starting with `-` (see the discussion about using `--` above).
## Guard against path traversal
Path traversal is a security where the program (GitLab) tries to restrict user