diff options
author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-02-18 11:28:18 +0400 |
---|---|---|
committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-02-18 11:28:18 +0400 |
commit | 020078663e401798d199a1a293ac59d990f81dad (patch) | |
tree | 6a142474a0fdd838b9348d794e680737a44c22e7 /app | |
parent | cfdf94fc279e45ddbe0bbb94022a7488c663501c (diff) |
Prevent xss attack over group name. Added regex validation for group and team name
Diffstat (limited to 'app')
-rw-r--r-- | app/helpers/application_helper.rb | 9 | ||||
-rw-r--r-- | app/helpers/projects_helper.rb | 2 | ||||
-rw-r--r-- | app/models/namespace.rb | 8 | ||||
-rw-r--r-- | app/models/user_team.rb | 5 |
4 files changed, 18 insertions, 6 deletions
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 196105f0119..d02130c5eb1 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -73,8 +73,8 @@ module ApplicationHelper def search_autocomplete_source projects = current_user.authorized_projects.map { |p| { label: "project: #{p.name_with_namespace}", url: project_path(p) } } - groups = current_user.authorized_groups.map { |group| { label: "group: #{group.name}", url: group_path(group) } } - teams = current_user.authorized_teams.map { |team| { label: "team: #{team.name}", url: team_path(team) } } + groups = current_user.authorized_groups.map { |group| { label: "group: #{simple_sanitize(group.name)}", url: group_path(group) } } + teams = current_user.authorized_teams.map { |team| { label: "team: #{simple_sanitize(team.name)}", url: team_path(team) } } default_nav = [ { label: "My Profile", url: profile_path }, @@ -159,8 +159,13 @@ module ApplicationHelper alt: "Sign in with #{provider.to_s.titleize}") end + def simple_sanitize str + sanitize(str, tags: %w(a span)) + end + def image_url(source) root_url + path_to_image(source) end + alias_method :url_to_image, :image_url end diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb index 05303e86ae8..8225014a2a3 100644 --- a/app/helpers/projects_helper.rb +++ b/app/helpers/projects_helper.rb @@ -56,7 +56,7 @@ module ProjectsHelper def project_title project if project.group content_tag :span do - link_to(project.group.name, group_path(project.group)) + " / " + project.name + link_to(simple_sanitize(project.group.name), group_path(project.group)) + " / " + project.name end else project.name diff --git a/app/models/namespace.rb b/app/models/namespace.rb index 4e157839369..385fa291b48 100644 --- a/app/models/namespace.rb +++ b/app/models/namespace.rb @@ -17,11 +17,15 @@ class Namespace < ActiveRecord::Base has_many :projects, dependent: :destroy belongs_to :owner, class_name: "User" - validates :name, presence: true, uniqueness: true + validates :owner, presence: true + validates :name, presence: true, uniqueness: true, + length: { within: 0..255 }, + format: { with: Gitlab::Regex.name_regex, + message: "only letters, digits, spaces & '_' '-' '.' allowed." } + validates :path, uniqueness: true, presence: true, length: { within: 1..255 }, format: { with: Gitlab::Regex.path_regex, message: "only letters, digits & '_' '-' '.' allowed. Letter should be first" } - validates :owner, presence: true delegate :name, to: :owner, allow_nil: true, prefix: true diff --git a/app/models/user_team.rb b/app/models/user_team.rb index dc8cf9eeb22..2f3091c2353 100644 --- a/app/models/user_team.rb +++ b/app/models/user_team.rb @@ -21,8 +21,11 @@ class UserTeam < ActiveRecord::Base has_many :projects, through: :user_team_project_relationships has_many :members, through: :user_team_user_relationships, source: :user - validates :name, presence: true, uniqueness: true validates :owner, presence: true + validates :name, presence: true, uniqueness: true, + length: { within: 0..255 }, + format: { with: Gitlab::Regex.name_regex, + message: "only letters, digits, spaces & '_' '-' '.' allowed." } validates :path, uniqueness: true, presence: true, length: { within: 1..255 }, format: { with: Gitlab::Regex.path_regex, message: "only letters, digits & '_' '-' '.' allowed. Letter should be first" } |