Merge remote-tracking branch 'dev/13-0-stable' into 13-0-stable

5 files changed, 22 insertions, 8 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e264cfa0e..5ab4406fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Gitaly changelog
 
+## 13.0.12
+
+### Security (1 change)
+
+- Fix injection of arbitrary `http.*` options.
+
+
+## 13.0.11
+
+This version has been skipped due to packaging problems.
+
 ## 13.0.10
 
 - No changes.
diff --git a/VERSION b/VERSION
index e6d8555d4..29f7de2a2 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-13.0.10
+13.0.12
diff --git a/internal/service/repository/create_from_url.go b/internal/service/repository/create_from_url.go
index 57cb89946..db76a4e25 100644
--- a/internal/service/repository/create_from_url.go
+++ b/internal/service/repository/create_from_url.go
@@ -23,10 +23,13 @@ func cloneFromURLCommand(ctx context.Context, repoURL, repositoryFullPath string
 		return nil, helper.ErrInternal(err)
 	}
 
-	flags := []git.Option{
+	globalFlags := []git.Option{
+		git.ValueFlag{Name: "-c", Value: "http.followRedirects=false"},
+	}
+
+	cloneFlags := []git.Option{
 		git.Flag{Name: "--bare"},
 		git.Flag{Name: "--quiet"},
-		git.ValueFlag{Name: "-c", Value: "http.followRedirects=false"},
 	}
 
 	if u.User != nil {
@@ -41,12 +44,12 @@ func cloneFromURLCommand(ctx context.Context, repoURL, repositoryFullPath string
 
 		u.User = nil
 		authHeader := fmt.Sprintf("Authorization: Basic %s", base64.StdEncoding.EncodeToString([]byte(creds)))
-		flags = append(flags, git.ValueFlag{Name: "-c", Value: fmt.Sprintf("http.%s.extraHeader=%s", u.String(), authHeader)})
+		globalFlags = append(globalFlags, git.ValueFlag{Name: "-c", Value: fmt.Sprintf("http.extraHeader=%s", authHeader)})
 	}
 
-	return git.SafeBareCmd(ctx, git.CmdStream{Err: stderr}, nil, nil, git.SubCmd{
+	return git.SafeBareCmd(ctx, git.CmdStream{Err: stderr}, nil, globalFlags, git.SubCmd{
 		Name:        "clone",
-		Flags:       flags,
+		Flags:       cloneFlags,
 		PostSepArgs: []string{u.String(), repositoryFullPath},
 	})
 }
diff --git a/internal/service/repository/create_from_url_test.go b/internal/service/repository/create_from_url_test.go
index 526c2cf64..b08737e38 100644
--- a/internal/service/repository/create_from_url_test.go
+++ b/internal/service/repository/create_from_url_test.go
@@ -77,7 +77,7 @@ func TestCloneRepositoryFromUrlCommand(t *testing.T) {
 
 	expectedScrubbedURL := "https://www.example.com/secretrepo.git"
 	expectedBasicAuthHeader := fmt.Sprintf("Authorization: Basic %s", base64.StdEncoding.EncodeToString([]byte("user:pass!?@")))
-	expectedHeader := fmt.Sprintf("http.%s.extraHeader=%s", expectedScrubbedURL, expectedBasicAuthHeader)
+	expectedHeader := fmt.Sprintf("http.extraHeader=%s", expectedBasicAuthHeader)
 
 	var args = cmd.Args()
 	require.Contains(t, args, expectedScrubbedURL)
diff --git a/ruby/proto/gitaly/version.rb b/ruby/proto/gitaly/version.rb
index 1cb265486..2c523f5f4 100644
--- a/ruby/proto/gitaly/version.rb
+++ b/ruby/proto/gitaly/version.rb
@@ -1,5 +1,5 @@
 # This file was auto-generated by release-tools
 #  https://gitlab.com/gitlab-org/release-tools/-/blob/master/lib/release_tools/release/gitaly_release.rb
 module Gitaly
-  VERSION = '13.0.10'
+  VERSION = '13.0.12'
 end