kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'security-dos-issue-and-commit-comments-master' into 'master'

Browse source 
Fix invalid byte sequence

See merge request gitlab/gitlabhq!3545
This commit is contained in:
GitLab Release Tools Bot 2019-11-26 17:02:26 +00:00
commit f183054027
3 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
changelogs/unreleased/security-dos-issue-and-commit-comments-master.yml Normal file
View file

@ -0,0 +1,5 @@
---
title: Fix 500 error caused by invalid byte sequences in links
merge_request:
author:
type: security

2
lib/banzai/filter/relative_link_filter.rb
View file

@ -172,7 +172,7 @@ module Banzai
end end
def cleaned_file_path(uri) def cleaned_file_path(uri)
Addressable::URI.unescape(uri.path).delete("\0").chomp("/") Addressable::URI.unescape(uri.path).scrub.delete("\0").chomp("/")
end end
def relative_file_path(uri) def relative_file_path(uri)

5
spec/lib/banzai/filter/relative_link_filter_spec.rb
View file

@ -119,6 +119,11 @@ describe Banzai::Filter::RelativeLinkFilter do
expect { filter(act) }.not_to raise_error expect { filter(act) }.not_to raise_error
end end
it 'does not raise an exception on URIs containing invalid utf-8 byte sequences' do
act = link("%FF")
expect { filter(act) }.not_to raise_error
end
it 'does not raise an exception with a garbled path' do it 'does not raise an exception with a garbled path' do
act = link("open(/var/tmp/):%20/location%0Afrom:%20/test") act = link("open(/var/tmp/):%20/location%0Afrom:%20/test")
expect { filter(act) }.not_to raise_error expect { filter(act) }.not_to raise_error