app/services/projects/readme_renderer_service.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# frozen_string_literal: true

module Projects
  class ReadmeRendererService < BaseService
    include Rails.application.routes.url_helpers

    TEMPLATE_PATH = Rails.root.join('app', 'views', 'projects', 'readme_templates')

    def execute
      render(params[:template_name] || :default)
    end

    private

    def render(template_name)
      ERB.new(File.read(sanitized_filename(template_name)), trim_mode: '<>').result(binding)
    end

    def sanitized_filename(template_name)
      path = Gitlab::Utils.check_path_traversal!("#{template_name}.md.tt")
      path = TEMPLATE_PATH.join(path).to_s
      Gitlab::Utils.check_allowed_absolute_path!(path, [TEMPLATE_PATH.to_s])

      path
    end
  end
end