diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2023-05-22 21:44:12 +0300 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2023-05-22 21:44:12 +0300 |
| commit | 34d6370bacdf1849de3618f23faaa9de76612e31 (patch) | |
| tree | 1420e018fea4068504d059141212502e6f9ac040 /app/uploaders | |
| parent | 727b75d3e8ecb88c70edbb017f29a8da302656c0 (diff) | |
Add latest changes from gitlab-org/security/gitlab@16-0-stable-eev16.0.1
Diffstat (limited to 'app/uploaders')
| -rw-r--r-- | app/uploaders/object_storage.rb | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/app/uploaders/object_storage.rb b/app/uploaders/object_storage.rb index 4188e0caa8e..0a30f0e99f7 100644 --- a/app/uploaders/object_storage.rb +++ b/app/uploaders/object_storage.rb @@ -410,6 +410,8 @@ module ObjectStorage end def retrieve_from_store!(identifier) + Gitlab::Utils.check_path_traversal!(identifier) + # We need to force assign the value of @filename so that we will still # get the original_filename in cases wherein the file points to a random generated # path format. This happens for direct uploaded files to final location. |