diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-04-13 21:56:27 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-04-13 21:56:27 +0300 |
commit | 09b628c32e2c0bf54347745cf7d165cf987731c0 (patch) | |
tree | 90087576f91c250ebb71fa9bf377878e0a7feb81 /lib/gitlab | |
parent | d979a5b16b918928ba290135da1e2df07aeda887 (diff) |
Add latest changes from gitlab-org/security/gitlab@13-10-stable-ee
Diffstat (limited to 'lib/gitlab')
-rw-r--r-- | lib/gitlab/sanitizers/exif.rb | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/lib/gitlab/sanitizers/exif.rb b/lib/gitlab/sanitizers/exif.rb index ed3e32f3e79..eec50deb61e 100644 --- a/lib/gitlab/sanitizers/exif.rb +++ b/lib/gitlab/sanitizers/exif.rb @@ -45,6 +45,7 @@ module Gitlab ALLOWED_TAGS = WHITELISTED_TAGS + IGNORED_TAGS EXCLUDE_PARAMS = WHITELISTED_TAGS.map { |tag| "-#{tag}" } + ALLOWED_MIME_TYPES = %w(image/jpeg image/tiff).freeze attr_reader :logger @@ -96,12 +97,12 @@ module Gitlab end end + private + def extra_tags(path) exif_tags(path).keys - ALLOWED_TAGS end - private - def remove_and_store(tmpdir, src_path, uploader) exec_remove_exif!(src_path) logger.info "#{upload_ref(uploader.upload)}: exif removed, storing" @@ -133,15 +134,26 @@ module Gitlab # upload is stored into the file with the original name - this filename # is used by carrierwave when storing the file back to the storage filename = File.join(dir, uploader.filename) + contents = uploader.read + + check_for_allowed_types(contents) File.open(filename, 'w') do |file| file.binmode - file.write uploader.read + file.write contents end filename end + def check_for_allowed_types(contents) + mime_type = Gitlab::Utils::MimeType.from_string(contents) + + unless ALLOWED_MIME_TYPES.include?(mime_type) + raise "File type #{mime_type} not supported. Only supports #{ALLOWED_MIME_TYPES.join(", ")}." + end + end + def upload_ref(upload) "#{upload.id}:#{upload.path}" end |