diff options
| author | James Edwards-Jones <jedwardsjones@gitlab.com> | 2017-08-08 20:36:24 +0300 |
|---|---|---|
| committer | James Edwards-Jones <jedwardsjones@gitlab.com> | 2017-08-10 22:47:28 +0300 |
| commit | b29692168184cef044c6a1b244f791c56c10fb1c (patch) | |
| tree | 1addaf5d18bb1b354febe54d5ccd5f84635f8966 /lib/gitlab/url_blocker.rb | |
| parent | 334915d50884e54ed8034b4b8820f285b14837c5 (diff) | |
Merge branch 'rs-alphanumeric-ssh-params' into 'security-9-4'
Ensure user and hostnames begin with an alnum character in UrlBlocker
See merge request !2138
Diffstat (limited to 'lib/gitlab/url_blocker.rb')
| -rw-r--r-- | lib/gitlab/url_blocker.rb | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index 7e14a566696..fee1a127fd7 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -19,6 +19,8 @@ module Gitlab return false if internal?(uri) return true if blocked_port?(uri.port) + return true if blocked_user_or_hostname?(uri.user) + return true if blocked_user_or_hostname?(uri.hostname) server_ips = Resolv.getaddresses(uri.hostname) return true if (blocked_ips & server_ips).any? @@ -37,6 +39,12 @@ module Gitlab port < 1024 && !VALID_PORTS.include?(port) end + def blocked_user_or_hostname?(value) + return false if value.blank? + + value !~ /\A\p{Alnum}/ + end + def internal?(uri) internal_web?(uri) || internal_shell?(uri) end |