From eda8156e5c2b9bd026e7f56c0fa36e7cd7007df5 Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Wed, 11 Jul 2018 10:59:56 -0700 Subject: [PATCH 1/5] Fix symlink vulnerability in project import Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/49133 --- changelogs/unreleased/sh-fix-issue-49133.yml | 5 +++++ lib/gitlab/import_export/file_importer.rb | 3 ++- spec/lib/gitlab/import_export/file_importer_spec.rb | 7 +++++++ 3 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 changelogs/unreleased/sh-fix-issue-49133.yml diff --git a/changelogs/unreleased/sh-fix-issue-49133.yml b/changelogs/unreleased/sh-fix-issue-49133.yml new file mode 100644 index 00000000000..847220d88b2 --- /dev/null +++ b/changelogs/unreleased/sh-fix-issue-49133.yml @@ -0,0 +1,5 @@ +--- +title: Fix symlink vulnerability in project import +merge_request: +author: +type: security diff --git a/lib/gitlab/import_export/file_importer.rb b/lib/gitlab/import_export/file_importer.rb index 0f4c3498036..de36adc1d5a 100644 --- a/lib/gitlab/import_export/file_importer.rb +++ b/lib/gitlab/import_export/file_importer.rb @@ -4,6 +4,7 @@ module Gitlab include Gitlab::ImportExport::CommandLineUtil MAX_RETRIES = 8 + WHITELISTED_FILENAMES = %w(. ..).freeze def self.import(*args) new(*args).import @@ -59,7 +60,7 @@ module Gitlab end def extracted_files - Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| f =~ %r{.*/\.{1,2}$} } + Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| WHITELISTED_FILENAMES.include?(File.basename(f)) } end end end diff --git a/spec/lib/gitlab/import_export/file_importer_spec.rb b/spec/lib/gitlab/import_export/file_importer_spec.rb index 58b9fb06cc5..265937f899e 100644 --- a/spec/lib/gitlab/import_export/file_importer_spec.rb +++ b/spec/lib/gitlab/import_export/file_importer_spec.rb @@ -7,6 +7,7 @@ describe Gitlab::ImportExport::FileImporter do let(:symlink_file) { "#{shared.export_path}/invalid.json" } let(:hidden_symlink_file) { "#{shared.export_path}/.hidden" } let(:subfolder_symlink_file) { "#{shared.export_path}/subfolder/invalid.json" } + let(:evil_symlink_file) { "#{shared.export_path}/.\nevil" } before do stub_const('Gitlab::ImportExport::FileImporter::MAX_RETRIES', 0) @@ -34,6 +35,10 @@ describe Gitlab::ImportExport::FileImporter do expect(File.exist?(hidden_symlink_file)).to be false end + it 'removes evil symlinks in root folder' do + expect(File.exist?(evil_symlink_file)).to be false + end + it 'removes symlinks in subfolders' do expect(File.exist?(subfolder_symlink_file)).to be false end @@ -75,5 +80,7 @@ describe Gitlab::ImportExport::FileImporter do FileUtils.touch(valid_file) FileUtils.ln_s(valid_file, symlink_file) FileUtils.ln_s(valid_file, subfolder_symlink_file) + FileUtils.ln_s(valid_file, hidden_symlink_file) + FileUtils.ln_s(valid_file, evil_symlink_file) end end From 1025059d1f15afa3ec55e7fff78633c517d0c3c2 Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Thu, 12 Jul 2018 05:56:15 -0700 Subject: [PATCH 2/5] Rename WHITELISTED_FILENAMES => IGNORED_FILENAMES --- lib/gitlab/import_export/file_importer.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/gitlab/import_export/file_importer.rb b/lib/gitlab/import_export/file_importer.rb index de36adc1d5a..4c411f4847e 100644 --- a/lib/gitlab/import_export/file_importer.rb +++ b/lib/gitlab/import_export/file_importer.rb @@ -4,7 +4,7 @@ module Gitlab include Gitlab::ImportExport::CommandLineUtil MAX_RETRIES = 8 - WHITELISTED_FILENAMES = %w(. ..).freeze + IGNORED_FILENAMES = %w(. ..).freeze def self.import(*args) new(*args).import @@ -60,7 +60,7 @@ module Gitlab end def extracted_files - Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| WHITELISTED_FILENAMES.include?(File.basename(f)) } + Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| IGNORED_FILENAMES.include?(File.basename(f)) } end end end From bef5bf62dcacc725dca76acfeed6ccb99aac8569 Mon Sep 17 00:00:00 2001 From: GitLab Release Tools Bot Date: Tue, 17 Jul 2018 12:20:34 +0000 Subject: [PATCH 3/5] Update CHANGELOG.md for 11.0.4 [ci skip] --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e90f599ced1..ba26dc47e71 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,13 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 11.0.4 (2018-07-17) + +### Security (1 change) + +- Fix symlink vulnerability in project import. + + ## 11.0.3 (2018-07-05) ### Fixed (14 changes, 1 of them is from the community) From 1714e608a1fd7de824307843a3be91b0cbb4f68d Mon Sep 17 00:00:00 2001 From: GitLab Release Tools Bot Date: Tue, 17 Jul 2018 12:24:53 +0000 Subject: [PATCH 4/5] Update CHANGELOG.md for 10.8.6 [ci skip] --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ba26dc47e71..54a4b583887 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -302,6 +302,14 @@ entry. - Workhorse to send raw diff and patch for commits. +## 10.8.6 (2018-07-17) + +### Security (2 changes) + +- Fix symlink vulnerability in project import. +- Merge branch 'fix-mr-widget-border' into 'master'. + + ## 10.8.5 (2018-06-21) ### Security (5 changes) From ffa970a5d227352cbd6ee8d0702cbb138287ec56 Mon Sep 17 00:00:00 2001 From: GitLab Release Tools Bot Date: Tue, 17 Jul 2018 12:27:49 +0000 Subject: [PATCH 5/5] Update CHANGELOG.md for 10.7.7 [ci skip] --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 54a4b583887..e1a6a014c57 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -539,6 +539,13 @@ entry. - Gitaly handles repository forks by default. +## 10.7.7 (2018-07-17) + +### Security (1 change) + +- Fix symlink vulnerability in project import. + + ## 10.7.6 (2018-06-21) ### Security (6 changes)