diff options
author | Bob Van Landuyt <bob@gitlab.com> | 2018-09-24 18:47:29 +0300 |
---|---|---|
committer | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-09-24 19:00:38 +0300 |
commit | 2952d0d8500f2a83d0e712a7b5c6b71a8d1172ae (patch) | |
tree | 26ec0c0b7317c011e09585550de2938c34660c08 /lib/gitlab | |
parent | 9730d13ba01cba7bd3c8e32265fd5d286218b27a (diff) |
Merge branch 'sh-sh-block-other-localhost-11-2' into 'security-11-2'
Block loopback addresses in UrlBlocker (11.2 port)
See merge request gitlab/gitlabhq!2522
Diffstat (limited to 'lib/gitlab')
-rw-r--r-- | lib/gitlab/url_blocker.rb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index 3b483f27e70..a2cce9151c3 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -30,6 +30,7 @@ module Gitlab end validate_localhost!(addrs_info) unless allow_localhost + validate_loopback!(addrs_info) unless allow_localhost validate_local_network!(addrs_info) unless allow_local_network validate_link_local!(addrs_info) unless allow_local_network @@ -84,6 +85,12 @@ module Gitlab raise BlockedUrlError, "Requests to localhost are not allowed" end + def validate_loopback!(addrs_info) + return unless addrs_info.any? { |addr| addr.ipv4_loopback? || addr.ipv6_loopback? } + + raise BlockedUrlError, "Requests to loopback addresses are not allowed" + end + def validate_local_network!(addrs_info) return unless addrs_info.any? { |addr| addr.ipv4_private? || addr.ipv6_sitelocal? } |