Commit graph

6 commits

Author SHA1 Message Date
GitLab Bot
18a102a5b9 Add latest changes from gitlab-org/gitlab@master 2019-11-08 03:06:48 +00:00
George Koltsov
e5e1c907c0 Add outbound requests setting for system hooks
This MR adds new application setting to network section
`allow_local_requests_from_system_hooks`. Prior to this change
system hooks were allowed to do local network requests by default
and we are adding an ability for admins to control it.
2019-08-02 15:39:18 +01:00
Douwe Maan
a9bcddee4c Protect Gitlab::HTTP against DNS rebinding attack
Gitlab::HTTP now resolves the hostname only once, verifies the IP is not
blocked, and then uses the same IP to perform the actual request, while
passing the original hostname in the `Host` header and SSL SNI field.
2019-05-30 10:47:31 -03:00
Heinrich Lee Yu
880792a04e Catch RedirectionTooDeep Exception in webhooks 2018-10-19 05:55:06 +00:00
Douwe Maan
2e3bc6a941
Raise more descriptive errors when URLs are blocked 2018-04-02 17:20:01 +02:00
Douwe Maan
95ced3bb5f Merge branch 'fj-15329-services-callbacks-ssrf' into 'security-10-6'
Server Side Request Forgery in Services and Web Hooks

See merge request gitlab/gitlabhq!2337
2018-03-21 14:39:21 +00:00