Merge branch 'sh-sh-block-other-localhost-11-2' into 'security-11-2'

Block loopback addresses in UrlBlocker (11.2 port)

See merge request gitlab/gitlabhq!2522

1 files changed, 7 insertions, 0 deletions

diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb
index 3b483f27e70..a2cce9151c3 100644
--- a/lib/gitlab/url_blocker.rb
+++ b/lib/gitlab/url_blocker.rb
@@ -30,6 +30,7 @@ module Gitlab
         end
 
         validate_localhost!(addrs_info) unless allow_localhost
+        validate_loopback!(addrs_info) unless allow_localhost
         validate_local_network!(addrs_info) unless allow_local_network
         validate_link_local!(addrs_info) unless allow_local_network
 
@@ -84,6 +85,12 @@ module Gitlab
         raise BlockedUrlError, "Requests to localhost are not allowed"
       end
 
+      def validate_loopback!(addrs_info)
+        return unless addrs_info.any? { |addr| addr.ipv4_loopback? || addr.ipv6_loopback? }
+
+        raise BlockedUrlError, "Requests to loopback addresses are not allowed"
+      end
+
       def validate_local_network!(addrs_info)
         return unless addrs_info.any? { |addr| addr.ipv4_private? || addr.ipv6_sitelocal? }