diff options
author | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-24 15:48:55 +0300 |
---|---|---|
committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-24 15:48:58 +0300 |
commit | 97f8bc37667d42345cecabfe4a5a9fee702514b7 (patch) | |
tree | 34868d4dbce6a42eaee2f70f82bb4bc2cf5f3714 /lib | |
parent | f4ef3ed11a575f54a70712ae69c47c8b182f213c (diff) |
Merge branch 'security-fix-lfs-import-project-ssrf-forgery-11-7' into 'security-11-7'
[11.7] LFS object forgery in project import
See merge request gitlab/gitlabhq!2817
(cherry picked from commit d618b5b493d9c8d5e50a4e98f0f3f9bd590db9dc)
5aeac80a Added validations to prevent LFS object forgery
Diffstat (limited to 'lib')
-rw-r--r-- | lib/gitlab/github_import/importer/lfs_object_importer.rb | 8 | ||||
-rw-r--r-- | lib/gitlab/github_import/representation/lfs_object.rb | 4 |
2 files changed, 7 insertions, 5 deletions
diff --git a/lib/gitlab/github_import/importer/lfs_object_importer.rb b/lib/gitlab/github_import/importer/lfs_object_importer.rb index a88c17aaf82..195383fd3e9 100644 --- a/lib/gitlab/github_import/importer/lfs_object_importer.rb +++ b/lib/gitlab/github_import/importer/lfs_object_importer.rb @@ -13,10 +13,12 @@ module Gitlab @project = project end + def lfs_download_object + LfsDownloadObject.new(oid: lfs_object.oid, size: lfs_object.size, link: lfs_object.link) + end + def execute - Projects::LfsPointers::LfsDownloadService - .new(project) - .execute(lfs_object.oid, lfs_object.download_link) + Projects::LfsPointers::LfsDownloadService.new(project, lfs_download_object).execute end end end diff --git a/lib/gitlab/github_import/representation/lfs_object.rb b/lib/gitlab/github_import/representation/lfs_object.rb index debe0fa0baf..a4606173f49 100644 --- a/lib/gitlab/github_import/representation/lfs_object.rb +++ b/lib/gitlab/github_import/representation/lfs_object.rb @@ -9,11 +9,11 @@ module Gitlab attr_reader :attributes - expose_attribute :oid, :download_link + expose_attribute :oid, :link, :size # Builds a lfs_object def self.from_api_response(lfs_object) - new({ oid: lfs_object[0], download_link: lfs_object[1] }) + new({ oid: lfs_object.oid, link: lfs_object.link, size: lfs_object.size }) end # Builds a new lfs_object using a Hash that was built from a JSON payload. |