diff options
author | Alex Hanselka <alex@gitlab.com> | 2018-12-14 02:57:41 +0300 |
---|---|---|
committer | Alex Hanselka <alex@gitlab.com> | 2018-12-14 02:57:41 +0300 |
commit | 0b7e870f9e938f3776d91866f491302945d604ba (patch) | |
tree | 5415d5de22c3ea389eefd6cf4167a20eca2e2b11 /spec | |
parent | 6925165f8b4404894d8bca2613c22cb943d3f774 (diff) | |
parent | 3ee0710d1d47bec895568563aeca2d3b53bfa8ce (diff) |
Merge branch 'security-2754-fix-lfs-import' into 'master'
[MASTER]: Validate LFS hrefs before downloading them
Closes #2754
See merge request gitlab/gitlabhq!2696
Diffstat (limited to 'spec')
-rw-r--r-- | spec/services/projects/lfs_pointers/lfs_download_service_spec.rb | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb b/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb index 6af5bfc7689..d7d7f1874eb 100644 --- a/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb +++ b/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb @@ -54,6 +54,18 @@ describe Projects::LfsPointers::LfsDownloadService do end end + context 'when a bad URL is used' do + where(download_link: ['/etc/passwd', 'ftp://example.com', 'http://127.0.0.2']) + + with_them do + it 'does not download the file' do + expect(subject).not_to receive(:download_and_save_file) + + expect { subject.execute(oid, download_link) }.not_to change { LfsObject.count } + end + end + end + context 'when an lfs object with the same oid already exists' do before do create(:lfs_object, oid: 'oid') |