gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.

Age	Commit message (Collapse)	Author
2019-07-24	[ADD] outbound requests whitelist	Reuben Pereira
	Signed-off-by: Istvan szalai <istvan.szalai@savoirfairelinux.com>
2019-07-12	Don't use bang method when there is no safe method	Reuben Pereira
	https://github.com/rubocop-hq/ruby-style-guide#dangerous-method-bang
2019-05-30	Add DNS rebinding protection settings	Oswaldo Ferreira

2019-05-30	Protect Gitlab::HTTP against DNS rebinding attack	Douwe Maan
	Gitlab::HTTP now resolves the hostname only once, verifies the IP is not blocked, and then uses the same IP to perform the actual request, while passing the original hostname in the `Host` header and SSL SNI field.
2019-04-11	Align UrlValidator to validate_url gem implementation.	Thong Kuah
	Renamed UrlValidator to AddressableUrlValidator to avoid 'url:' naming collision with ActiveModel::Validations::UrlValidator in 'validates' statement. Make use of the options attribute of the parent class ActiveModel::EachValidator. Add more options: allow_nil, allow_blank, message. Renamed 'protocols' option to 'schemes' to match the option naming from UrlValidator.
2018-12-06	Allow URLs to be validated as ascii_only	James Edwards-Jones
	Restricts unicode characters and IDNA deviations which could be used in a phishing attack
2018-11-29	Merge branch 'security-11-5-fix-webhook-ssrf-ipv6' into 'security-11-5'	Steve Azzopardi
	[11.5] Fix SSRF in project integrations See merge request gitlab/gitlabhq!2611
2018-11-29	Merge branch 'security-stored-xss-for-environments' into 'master'	Cindy Pallares
	[master] Stored XSS for Environments Closes #2727 See merge request gitlab/gitlabhq!2594
2018-09-06	Block loopback addresses in UrlBlocker	Stan Hu
	Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/51128
2018-08-13	Block link-local addresses in URLBlocker	Stan Hu
	Closes https://gitlab.com/gitlab-com/migration/issues/766
2018-06-11	Avoid checking the user format in every url validation	Francisco Javier López

2018-06-01	Add validation to webhook and service URLs to ensure they are not blocked ↵	Francisco Javier López
	because of SSRF
2018-04-02	Rename allow_private_networks to allow_local_network	Douwe Maan

2018-03-21	Merge branch 'fj-15329-services-callbacks-ssrf' into 'security-10-6'	Douwe Maan
	Server Side Request Forgery in Services and Web Hooks See merge request gitlab/gitlabhq!2337
2017-11-09	Merge branch 'ssrf-protections-round-2' into 'security-10-1'	Douwe Maan
	Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions See merge request gitlab/gitlabhq!2219 (cherry picked from commit 4a1e73783d5480aa514db7b53e10c075f95580b5) 1bffa0c3 Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions
2017-08-10	Merge branch 'rs-alphanumeric-ssh-params' into 'security-9-4'	James Edwards-Jones
	Ensure user and hostnames begin with an alnum character in UrlBlocker See merge request !2138
2017-07-27	Remove superfluous lib: true, type: redis, service: true, models: true, ↵	Rémy Coutable
	services: true, no_db: true, api: true Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-03-21	Merge branch 'ssrf' into 'security'	Douwe Maan
	Protect server against SSRF in project import URLs See merge request !2068