Add latest changes from gitlab-org/gitlab@master

1 files changed, 8 insertions, 1 deletions

diff --git a/lib/gitlab/middleware/handle_malformed_strings.rb b/lib/gitlab/middleware/handle_malformed_strings.rb
index 5fe3e6a1c73..bb2a8ead525 100644
--- a/lib/gitlab/middleware/handle_malformed_strings.rb
+++ b/lib/gitlab/middleware/handle_malformed_strings.rb
@@ -26,13 +26,20 @@ module Gitlab
 
         request = Rack::Request.new(request)
 
-        return true if string_malformed?(request.path)
+        return true if malformed_path?(request.path)
 
         request.params.values.any? do |value|
           param_has_null_byte?(value)
         end
       end
 
+      def malformed_path?(path)
+        string_malformed?(Rack::Utils.unescape(path))
+      rescue ArgumentError
+        # Rack::Utils.unescape raised this, path is malformed.
+        true
+      end
+
       def param_has_null_byte?(value, depth = 0)
         # Guard against possible attack sending large amounts of nested params
         # Should be safe as deeply nested params are highly uncommon.