diff options
author | Cindy Pallares <cindy@gitlab.com> | 2018-12-06 21:38:43 +0300 |
---|---|---|
committer | Cindy Pallares <cindy@gitlab.com> | 2018-12-06 21:38:43 +0300 |
commit | a50c777d958d6e0f5c4cfc02294a40da088ceabd (patch) | |
tree | d3e5dc9ea02671ffa86f997175c17a05741ae952 /lib | |
parent | daca42ac648166ea90ad6eb87e912c0b8c852933 (diff) | |
parent | 69645389e925a106f00fed555fde54c38f26816a (diff) |
Merge branch '54857-fix-templates-path-traversal' into 'master'
[master]: Prevent a path traversal attack on global file templates
Closes #2745
See merge request gitlab/gitlabhq!2677
Diffstat (limited to 'lib')
-rw-r--r-- | lib/api/templates.rb | 2 | ||||
-rw-r--r-- | lib/gitlab/template/finders/global_template_finder.rb | 4 | ||||
-rw-r--r-- | lib/gitlab/template/finders/repo_template_finder.rb | 5 | ||||
-rw-r--r-- | lib/gitlab/utils.rb | 9 |
4 files changed, 19 insertions, 1 deletions
diff --git a/lib/api/templates.rb b/lib/api/templates.rb index 8dab19d50c2..51f357d9477 100644 --- a/lib/api/templates.rb +++ b/lib/api/templates.rb @@ -82,7 +82,7 @@ module API params do requires :name, type: String, desc: 'The name of the template' end - get "templates/#{template_type}/:name" do + get "templates/#{template_type}/:name", requirements: { name: /[\w\.-]+/ } do finder = TemplateFinder.build(template_type, nil, name: declared(params)[:name]) new_template = finder.execute diff --git a/lib/gitlab/template/finders/global_template_finder.rb b/lib/gitlab/template/finders/global_template_finder.rb index 76bb9eb611e..2dd4b7a4092 100644 --- a/lib/gitlab/template/finders/global_template_finder.rb +++ b/lib/gitlab/template/finders/global_template_finder.rb @@ -18,6 +18,10 @@ module Gitlab def find(key) file_name = "#{key}#{@extension}" + # The key is untrusted input, so ensure we can't be directed outside + # of base_dir + Gitlab::Utils.check_path_traversal!(file_name) + directory = select_directory(file_name) directory ? File.join(category_directory(directory), file_name) : nil end diff --git a/lib/gitlab/template/finders/repo_template_finder.rb b/lib/gitlab/template/finders/repo_template_finder.rb index b92cefefb8f..8e234148a63 100644 --- a/lib/gitlab/template/finders/repo_template_finder.rb +++ b/lib/gitlab/template/finders/repo_template_finder.rb @@ -26,6 +26,11 @@ module Gitlab def find(key) file_name = "#{key}#{@extension}" + + # The key is untrusted input, so ensure we can't be directed outside + # of base_dir inside the repository + Gitlab::Utils.check_path_traversal!(file_name) + directory = select_directory(file_name) raise FileNotFoundError if directory.nil? diff --git a/lib/gitlab/utils.rb b/lib/gitlab/utils.rb index e0e8f598ba4..26fc56227a2 100644 --- a/lib/gitlab/utils.rb +++ b/lib/gitlab/utils.rb @@ -4,6 +4,15 @@ module Gitlab module Utils extend self + # Ensure that the relative path will not traverse outside the base directory + def check_path_traversal!(path) + raise StandardError.new("Invalid path") if path.start_with?("..#{File::SEPARATOR}") || + path.include?("#{File::SEPARATOR}..#{File::SEPARATOR}") || + path.end_with?("#{File::SEPARATOR}..") + + path + end + # Run system command without outputting to stdout. # # @param cmd [Array<String>] |