diff options
| author | Douwe Maan <douwe@gitlab.com> | 2017-11-07 11:30:38 +0300 |
|---|---|---|
| committer | Winnie Hellmann <winnie@gitlab.com> | 2017-11-07 22:07:53 +0300 |
| commit | ebf9d0c4e33ea1c7058c0d9b9121e6a8d03f034f (patch) | |
| tree | 40aa421690e9dd37e27e5afdce09dc146d58431d /lib/gitlab/url_blocker.rb | |
| parent | cc27e5febde641529cf2bd2492f0074497bc3667 (diff) | |
Merge branch 'ssrf-protections-round-2' into 'security-10-1'
Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions
See merge request gitlab/gitlabhq!2219
(cherry picked from commit 4a1e73783d5480aa514db7b53e10c075f95580b5)
1bffa0c3 Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions
Diffstat (limited to 'lib/gitlab/url_blocker.rb')
| -rw-r--r-- | lib/gitlab/url_blocker.rb | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index fee1a127fd7..13150ddab67 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -22,10 +22,12 @@ module Gitlab return true if blocked_user_or_hostname?(uri.user) return true if blocked_user_or_hostname?(uri.hostname) - server_ips = Resolv.getaddresses(uri.hostname) + server_ips = Addrinfo.getaddrinfo(uri.hostname, 80, nil, :STREAM).map(&:ip_address) return true if (blocked_ips & server_ips).any? rescue Addressable::URI::InvalidURIError return true + rescue SocketError + return false end false |