From 34d6370bacdf1849de3618f23faaa9de76612e31 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Mon, 22 May 2023 18:44:12 +0000
Subject: Add latest changes from gitlab-org/security/gitlab@16-0-stable-ee

---
 app/uploaders/object_storage.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'app/uploaders')

diff --git a/app/uploaders/object_storage.rb b/app/uploaders/object_storage.rb
index 4188e0caa8e..0a30f0e99f7 100644
--- a/app/uploaders/object_storage.rb
+++ b/app/uploaders/object_storage.rb
@@ -410,6 +410,8 @@ module ObjectStorage
     end
 
     def retrieve_from_store!(identifier)
+      Gitlab::Utils.check_path_traversal!(identifier)
+
       # We need to force assign the value of @filename so that we will still
       # get the original_filename in cases wherein the file points to a random generated
       # path format. This happens for direct uploaded files to final location.
-- 
cgit v1.2.3