blob: 8fd33a717c5ebd28bd6d149a21df8fd7e28ca0e4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
# frozen_string_literal: true
module Projects
class ReadmeRendererService < BaseService
include Rails.application.routes.url_helpers
TEMPLATE_PATH = Rails.root.join('app', 'views', 'projects', 'readme_templates')
def execute
render(params[:template_name] || :default)
end
private
def render(template_name)
ERB.new(File.read(sanitized_filename(template_name)), trim_mode: '<>').result(binding)
end
def sanitized_filename(template_name)
path = Gitlab::PathTraversal.check_path_traversal!("#{template_name}.md.tt")
path = TEMPLATE_PATH.join(path).to_s
Gitlab::PathTraversal.check_allowed_absolute_path!(path, [TEMPLATE_PATH.to_s])
path
end
end
end
|