Prevent a path traversal attack on global file templates

The API permits path traversal characters like '../' to be passed down
to the template finder. Detect these requests and cause them to fail
with a 500 response code.

2 files changed, 39 insertions, 0 deletions

diff --git a/spec/lib/gitlab/template/finders/global_template_finder_spec.rb b/spec/lib/gitlab/template/finders/global_template_finder_spec.rb
new file mode 100644
index 00000000000..c7f58fbd2a5
--- /dev/null
+++ b/spec/lib/gitlab/template/finders/global_template_finder_spec.rb
@@ -0,0 +1,35 @@
+require 'spec_helper'
+
+describe Gitlab::Template::Finders::GlobalTemplateFinder do
+  let(:base_dir) { Dir.mktmpdir }
+
+  def create_template!(name_with_category)
+    full_path = File.join(base_dir, name_with_category)
+    FileUtils.mkdir_p(File.dirname(full_path))
+    FileUtils.touch(full_path)
+  end
+
+  after do
+    FileUtils.rm_rf(base_dir)
+  end
+
+  subject(:finder) { described_class.new(base_dir, '', 'Foo' => '', 'Bar' => 'bar') }
+
+  describe '.find' do
+    it 'finds a template in the Foo category' do
+      create_template!('test-template')
+
+      expect(finder.find('test-template')).to be_present
+    end
+
+    it 'finds a template in the Bar category' do
+      create_template!('bar/test-template')
+
+      expect(finder.find('test-template')).to be_present
+    end
+
+    it 'does not permit path traversal requests' do
+      expect { finder.find('../foo') }.to raise_error(/Invalid path/)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb b/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb
index 2eabccd5dff..e329d55d837 100644
--- a/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb
+++ b/spec/lib/gitlab/template/finders/repo_template_finders_spec.rb
@@ -25,6 +25,10 @@ describe Gitlab::Template::Finders::RepoTemplateFinder do
 
       expect(result).to eq('files/html/500.html')
     end
+
+    it 'does not permit path traversal requests' do
+      expect { finder.find('../foo') }.to raise_error(/Invalid path/)
+    end
   end
 
   describe '#list_files_for' do