kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch '34259-project-denial-of-service-via-gitmodules-fix' into 'master'

Browse source 
Fixes project denial of service via gitmodules using Extended ASCII.

Closes #34259

See merge request gitlab-org/gitlab-ce!14301
This commit is contained in:
Robert Speicher 2017-09-19 03:46:31 +00:00
commit ff594bb3a9
3 changed files with 19 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
app/helpers/submodule_helper.rb
View file

@ -87,10 +87,14 @@ module SubmoduleHelper
namespace = @project.namespace.full_path namespace = @project.namespace.full_path
end end
[ begin
namespace_project_path(namespace, base), [
namespace_project_tree_path(namespace, base, commit) namespace_project_path(namespace, base),
] namespace_project_tree_path(namespace, base, commit)
]
rescue ActionController::UrlGenerationError
[nil, nil]
end
end end
def sanitize_submodule_url(url) def sanitize_submodule_url(url)

5
changelogs/unreleased/34259-project-denial-of-service-via-gitmodules-fix.yml Normal file
View file

@ -0,0 +1,5 @@
---
title: Fixes project denial of service via gitmodules using Extended ASCII.
merge_request: 14301
author:
type: fixed

6
spec/helpers/submodule_helper_spec.rb
View file

@ -147,6 +147,12 @@ describe SubmoduleHelper do
expect(helper.submodule_links(submodule_item)).to eq([nil, nil]) expect(helper.submodule_links(submodule_item)).to eq([nil, nil])
end end
it 'sanitizes invalid URL with extended ASCII' do
stub_url('é')
expect(helper.submodule_links(submodule_item)).to eq([nil, nil])
end
it 'returns original' do it 'returns original' do
stub_url('http://mygitserver.com/gitlab-org/gitlab-ce') stub_url('http://mygitserver.com/gitlab-org/gitlab-ce')
expect(submodule_links(submodule_item)).to eq([repo.submodule_url_for, nil]) expect(submodule_links(submodule_item)).to eq([repo.submodule_url_for, nil])