Commit graph

20 commits

Author SHA1 Message Date
Yorick Peterse
ae9838d035
Backport try_megabytes_to_bytes from EE
EE adds this method to Gitlab::Utils, which is also required by our
SimpleCov helper. This prevents us from injecting EE modules into
Gitlab::Utils, because the necessary bits for this are not yet in place.

To work around this we just backport try_megabytes_to_bytes, as there's
no particular reason to keep this in EE only.
2019-03-12 14:04:05 +01:00
Kamil Trzciński
0103d5be96 Add config_options|variables to BuildMetadata
These are data columns that store runtime configuration
of build needed to execute it on runner and within pipeline.

The definition of this data is that once used, and when no longer
needed (due to retry capability) they can be freely removed.

They use `jsonb` on PostgreSQL, and `text` on MySQL (due to lacking
support for json datatype on old enough version).
2019-01-04 16:38:17 +01:00
Rémy Coutable
f233c3bce0
Fix a frozen string error in lib/gitlab/utils.rb
Signed-off-by: Rémy Coutable <remy@rymai.me>
2018-12-10 16:08:58 +01:00
Cindy Pallares
a50c777d95 Merge branch '54857-fix-templates-path-traversal' into 'master'
[master]: Prevent a path traversal attack on global file templates

Closes #2745

See merge request gitlab/gitlabhq!2677
2018-12-06 18:38:43 +00:00
Nick Thomas
69645389e9
Prevent a path traversal attack on global file templates
The API permits path traversal characters like '../' to be passed down
to the template finder. Detect these requests and cause them to fail
with a 500 response code.
2018-12-05 14:12:35 +00:00
Grzegorz Bizon
4c7665f2f9 Pad encryption keys with UTF-8 0 instead of \0 char 2018-11-28 12:00:17 +01:00
Grzegorz Bizon
d1311119fa Fix static analysis in utf8 helper methods 2018-11-23 10:03:43 +01:00
Grzegorz Bizon
777b6713bb Ensure that db encryption keys have proper bytesize 2018-11-22 15:35:49 +01:00
Douglas Barbosa Alexandre
5c519d1194 Add a helper method to append path to a base URL
In Ruby 2.4, `URI.join("http://test//", "a").to_s` will
remove the double slash, however it's not the case in
Ruby 2.5. Using chomp should work better for the intention,
as we're not trying to allow things like ../ or / paths
resolution.

This helper method append path to host, making sure
there's one single slash as path separator.
2018-11-06 21:32:01 -08:00
Rubén Dávila
d28b1dfc46 Backport of EE !4989 2018-04-11 22:05:07 -05:00
Mario de la Ossa
f9d61717cf Gitlab::Utils - backport .ensure_array_from_string from EE 2018-03-06 21:16:55 +00:00
Robert Speicher
791ca43f3f Merge branch '41293-fix-command-injection-vulnerability-on-system_hook_push-queue-through-web-hook' into 'security-10-3'
Don't allow line breaks on HTTP headers

See merge request gitlab/gitlabhq!2277

(cherry picked from commit 7fc0a6fc096768a5604d6dd24d7d952e53300c82)

073b8f9c Don't allow line breaks on HTTP headers
2018-01-16 17:04:51 -08:00
Michael Kozono
ab814e4dd3 Backport which from EE 2017-12-01 15:26:40 -08:00
Bob Van Landuyt
bde39322f1 Add a linter for PO files 2017-08-31 14:10:04 +02:00
vanadium23
e99444bb2d Fix CI_PROJECT_PATH_SLUG slugify 2017-08-15 08:22:56 +03:00
Rémy Coutable
ddccd24c13 Remove superfluous lib: true, type: redis, service: true, models: true, services: true, no_db: true, api: true
Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-07-27 14:31:53 +02:00
Lin Jen-Shin
7f01167681 Fix tests and rubocop offense 2017-05-25 20:53:03 +08:00
Lin Jen-Shin
efebdba21d Frontend implementation, tests, and changelog 2017-05-25 19:31:21 +08:00
Douwe Maan
75f5fa997d Enable Rails/Delegate 2017-02-23 09:32:42 -06:00
Felipe Artur
f4e31b820e Fix project features default values 2016-11-01 11:03:56 -02:00