diff options
author | Jan Provaznik <jprovaznik@gitlab.com> | 2018-10-30 14:19:22 +0300 |
---|---|---|
committer | Jan Provaznik <jprovaznik@gitlab.com> | 2018-10-30 14:57:22 +0300 |
commit | f955e1a9bb86049fdcf471e112c15d85c317e3ca (patch) | |
tree | fe99cb9f081d6077b8dce8c83c6d8cb39b4e3039 /config | |
parent | 0a6f6119fa3e6f708e745bba369ecba18c3d07cc (diff) |
Merge branch 'security-kubeclient-ssrf-11-3' into 'security-11-3'
[11.3] Security kubeclient ssrf
See merge request gitlab/gitlabhq!2574
Diffstat (limited to 'config')
-rw-r--r-- | config/initializers/kubeclient.rb | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/config/initializers/kubeclient.rb b/config/initializers/kubeclient.rb index 7f115268b37..2d9f439fdc0 100644 --- a/config/initializers/kubeclient.rb +++ b/config/initializers/kubeclient.rb @@ -13,4 +13,25 @@ class Kubeclient::Client ns_prefix = build_namespace_prefix(namespace) rest_client["#{ns_prefix}#{entity_name_plural}/#{name}:#{port}/proxy"].url end + + # Monkey patch to set `max_redirects: 0`, so that kubeclient + # does not follow redirects and expose internal services. + # See https://gitlab.com/gitlab-org/gitlab-ce/issues/53158 + def create_rest_client(path = nil) + path ||= @api_endpoint.path + options = { + ssl_ca_file: @ssl_options[:ca_file], + ssl_cert_store: @ssl_options[:cert_store], + verify_ssl: @ssl_options[:verify_ssl], + ssl_client_cert: @ssl_options[:client_cert], + ssl_client_key: @ssl_options[:client_key], + proxy: @http_proxy_uri, + user: @auth_options[:username], + password: @auth_options[:password], + open_timeout: @timeouts[:open], + read_timeout: @timeouts[:read], + max_redirects: 0 + } + RestClient::Resource.new(@api_endpoint.merge(path).to_s, options) + end end |