kotovalexarian-likes-gitlab
/
gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'security-fj-crlf-injection' into 'master' 

[master] Fix CRLF issue in UrlValidator

See merge request gitlab/gitlabhq!2627
This commit is contained in:
Cindy Pallares 2018-11-28 19:06:44 +00:00
parent fe5f75930e
commit c0e5d9afee
No known key found for this signature in database
GPG Key ID: 8E13768AD1946B0C
5 changed files with 128 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
changelogs/unreleased/security-fj-crlf-injection.yml Normal file
View File

@ -0,0 +1,5 @@
---
title: Fix CRLF vulnerability in Project hooks
merge_request:
author:
type: security

19
lib/gitlab/url_blocker.rb
View File

@ -10,11 +10,8 @@ module Gitlab
def validate!(url, allow_localhost: false, allow_local_network: true, enforce_user: false, ports: [], protocols: [])
return true if url.nil?
begin
uri = Addressable::URI.parse(url)
rescue Addressable::URI::InvalidURIError
raise BlockedUrlError, "URI is invalid"
end
# Param url can be a string, URI or Addressable::URI
uri = parse_url(url)
# Allow imports from the GitLab instance itself but only from the configured ports
return true if internal?(uri)
@ -49,6 +46,18 @@ module Gitlab
private
def parse_url(url)
raise Addressable::URI::InvalidURIError if multiline?(url)
Addressable::URI.parse(url)
rescue Addressable::URI::InvalidURIError, URI::InvalidURIError
raise BlockedUrlError, 'URI is invalid'
end
def multiline?(url)
CGI.unescape(url.to_s) =~ /\n|\r/
end
def validate_port!(port, ports)
return if port.blank?
# Only ports under 1024 are restricted

115
spec/models/project_spec.rb
View File

@ -218,76 +218,93 @@ describe Project do
end
end
it 'does not allow an invalid URI as import_url' do
project = build(:project, import_url: 'invalid://')
describe 'import_url' do
it 'does not allow an invalid URI as import_url' do
project = build(:project, import_url: 'invalid://')
expect(project).not_to be_valid
end
expect(project).not_to be_valid
end
it 'does allow a SSH URI as import_url for persisted projects' do
project = create(:project)
project.import_url = 'ssh://test@gitlab.com/project.git'
it 'does allow a SSH URI as import_url for persisted projects' do
project = create(:project)
project.import_url = 'ssh://test@gitlab.com/project.git'
expect(project).to be_valid
end
expect(project).to be_valid
end
it 'does not allow a SSH URI as import_url for new projects' do
project = build(:project, import_url: 'ssh://test@gitlab.com/project.git')
it 'does not allow a SSH URI as import_url for new projects' do
project = build(:project, import_url: 'ssh://test@gitlab.com/project.git')
expect(project).not_to be_valid
end
expect(project).not_to be_valid
end
it 'does allow a valid URI as import_url' do
project = build(:project, import_url: 'http://gitlab.com/project.git')
it 'does allow a valid URI as import_url' do
project = build(:project, import_url: 'http://gitlab.com/project.git')
expect(project).to be_valid
end
expect(project).to be_valid
end
it 'allows an empty URI' do
project = build(:project, import_url: '')
it 'allows an empty URI' do
project = build(:project, import_url: '')
expect(project).to be_valid
end
expect(project).to be_valid
end
it 'does not produce import data on an empty URI' do
project = build(:project, import_url: '')
it 'does not produce import data on an empty URI' do
project = build(:project, import_url: '')
expect(project.import_data).to be_nil
end
expect(project.import_data).to be_nil
end
it 'does not produce import data on an invalid URI' do
project = build(:project, import_url: 'test://')
it 'does not produce import data on an invalid URI' do
project = build(:project, import_url: 'test://')
expect(project.import_data).to be_nil
end
expect(project.import_data).to be_nil
end
it "does not allow import_url pointing to localhost" do
project = build(:project, import_url: 'http://localhost:9000/t.git')
it "does not allow import_url pointing to localhost" do
project = build(:project, import_url: 'http://localhost:9000/t.git')
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Requests to localhost are not allowed')
end
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Requests to localhost are not allowed')
end
it "does not allow import_url with invalid ports for new projects" do
project = build(:project, import_url: 'http://github.com:25/t.git')
it "does not allow import_url with invalid ports for new projects" do
project = build(:project, import_url: 'http://github.com:25/t.git')
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 80, 443')
end
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 80, 443')
end
it "does not allow import_url with invalid ports for persisted projects" do
project = create(:project)
project.import_url = 'http://github.com:25/t.git'
it "does not allow import_url with invalid ports for persisted projects" do
project = create(:project)
project.import_url = 'http://github.com:25/t.git'
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 22, 80, 443')
end
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 22, 80, 443')
end
it "does not allow import_url with invalid user" do
project = build(:project, import_url: 'http://$user:password@github.com/t.git')
it "does not allow import_url with invalid user" do
project = build(:project, import_url: 'http://$user:password@github.com/t.git')
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Username needs to start with an alphanumeric character')
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Username needs to start with an alphanumeric character')
end
include_context 'invalid urls'
it 'does not allow urls with CR or LF characters' do
project = build(:project)
aggregate_failures do
urls_with_CRLF.each do |url|
project.import_url = url
expect(project).not_to be_valid
expect(project.errors.full_messages.first).to match(/is blocked: URI is invalid/)
end
end
end
end
describe 'project pending deletion' do

17
spec/support/shared_contexts/url_shared_context.rb Normal file
View File

@ -0,0 +1,17 @@
shared_context 'invalid urls' do
let(:urls_with_CRLF) do
["http://127.0.0.1:333/pa\rth",
"http://127.0.0.1:333/pa\nth",
"http://127.0a.0.1:333/pa\r\nth",
"http://127.0.0.1:333/path?param=foo\r\nbar",
"http://127.0.0.1:333/path?param=foo\rbar",
"http://127.0.0.1:333/path?param=foo\nbar",
"http://127.0.0.1:333/pa%0dth",
"http://127.0.0.1:333/pa%0ath",
"http://127.0a.0.1:333/pa%0d%0th",
"http://127.0.0.1:333/pa%0D%0Ath",
"http://127.0.0.1:333/path?param=foo%0Abar",
"http://127.0.0.1:333/path?param=foo%0Dbar",
"http://127.0.0.1:333/path?param=foo%0D%0Abar"]
end
end

26
spec/validators/url_validator_spec.rb
View File

@ -1,3 +1,5 @@
# frozen_string_literal: true
require 'spec_helper'
describe UrlValidator do
@ -6,6 +8,30 @@ describe UrlValidator do
include_examples 'url validator examples', described_class::DEFAULT_PROTOCOLS
describe 'validations' do
include_context 'invalid urls'
let(:validator) { described_class.new(attributes: [:link_url]) }
it 'returns error when url is nil' do
expect(validator.validate_each(badge, :link_url, nil)).to be_nil
expect(badge.errors.first[1]).to eq 'must be a valid URL'
end
it 'returns error when url is empty' do
expect(validator.validate_each(badge, :link_url, '')).to be_nil
expect(badge.errors.first[1]).to eq 'must be a valid URL'
end
it 'does not allow urls with CR or LF characters' do
aggregate_failures do
urls_with_CRLF.each do |url|
expect(validator.validate_each(badge, :link_url, url)[0]).to eq 'is blocked: URI is invalid'
end
end
end
end
context 'by default' do
let(:validator) { described_class.new(attributes: [:link_url]) }