diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-02-25 19:31:46 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-02-25 19:32:06 +0300 |
commit | e92c90758eb4126acc84962d37bb273d6d87b27b (patch) | |
tree | 6d5f4ca9731a6aa76b80372276c68ab39e0f4149 /lib/gitlab/email | |
parent | b485c8c3723dc5aaba15ab9fa258010d1ec66d61 (diff) |
Add latest changes from gitlab-org/security/gitlab@14-8-stable-ee
Diffstat (limited to 'lib/gitlab/email')
-rw-r--r-- | lib/gitlab/email/hook/validate_addresses_interceptor.rb | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/lib/gitlab/email/hook/validate_addresses_interceptor.rb b/lib/gitlab/email/hook/validate_addresses_interceptor.rb new file mode 100644 index 00000000000..e63f047e63d --- /dev/null +++ b/lib/gitlab/email/hook/validate_addresses_interceptor.rb @@ -0,0 +1,32 @@ +# frozen_string_literal: true + +module Gitlab + module Email + module Hook + # Check for unsafe characters in the envelope-from and -to addresses. + # These are passed directly as arguments to sendmail and are liable to shell injection attacks: + # https://github.com/mikel/mail/blob/2.7.1/lib/mail/network/delivery_methods/sendmail.rb#L53-L58 + class ValidateAddressesInterceptor + UNSAFE_CHARACTERS = /(\\|[^[:print:]])/.freeze + + def self.delivering_email(message) + addresses = Array(message.smtp_envelope_from) + Array(message.smtp_envelope_to) + + addresses.each do |address| + next unless address.match?(UNSAFE_CHARACTERS) + + Gitlab::AuthLogger.info( + message: 'Skipping email with unsafe characters in address', + address: address, + subject: message.subject + ) + + message.perform_deliveries = false + + break + end + end + end + end + end +end |