diff options
| author | Dylan Griffith <dyl.griffith@gmail.com> | 2017-11-19 14:01:01 +1100 |
|---|---|---|
| committer | Dylan Griffith <dyl.griffith@gmail.com> | 2018-02-13 11:07:12 +1100 |
| commit | 06c111ca8f4373069ad0d3bbcf9e1ce2f5fd6d97 (patch) | |
| tree | b96adc4b337cc42a436e6b4baec44527d9fd76cc | |
| parent | 498ade4801a822f8704390b10d178af9fe7987cb (diff) | |
| download | gitlab-ce-39885-ensure-users-cannot-create-environments-with-leading-slashes.tar.gz | |
Ensure users can't create environments with leading or trailing slashes (Fixes #39885)39885-ensure-users-cannot-create-environments-with-leading-slashes
| -rw-r--r-- | changelogs/unreleased/issue-39885.yml | 5 | ||||
| -rw-r--r-- | lib/gitlab/regex.rb | 8 | ||||
| -rw-r--r-- | spec/lib/gitlab/regex_spec.rb | 5 |
3 files changed, 16 insertions, 2 deletions
diff --git a/changelogs/unreleased/issue-39885.yml b/changelogs/unreleased/issue-39885.yml new file mode 100644 index 00000000000..452b12d3ea6 --- /dev/null +++ b/changelogs/unreleased/issue-39885.yml @@ -0,0 +1,5 @@ +--- +title: 'Ensure users cannot create environments with leading or trailing slashes (Fixes #39885)' +merge_request: !15273 +author: Dylan Griffith +type: fixed diff --git a/lib/gitlab/regex.rb b/lib/gitlab/regex.rb index 7ab85e1c35c..ac3de2a8f71 100644 --- a/lib/gitlab/regex.rb +++ b/lib/gitlab/regex.rb @@ -40,12 +40,16 @@ module Gitlab 'a-zA-Z0-9_/\\$\\{\\}\\. \\-' end + def environment_name_regex_chars_without_slash + 'a-zA-Z0-9_\\$\\{\\}\\. -' + end + def environment_name_regex - @environment_name_regex ||= /\A[#{environment_name_regex_chars}]+\z/.freeze + @environment_name_regex ||= /\A[#{environment_name_regex_chars_without_slash}]([#{environment_name_regex_chars}]*[#{environment_name_regex_chars_without_slash}])?\z/.freeze end def environment_name_regex_message - "can contain only letters, digits, '-', '_', '/', '$', '{', '}', '.', and spaces" + "can contain only letters, digits, '-', '_', '/', '$', '{', '}', '.', and spaces, but it cannot start or end with '/'" end def kubernetes_namespace_regex diff --git a/spec/lib/gitlab/regex_spec.rb b/spec/lib/gitlab/regex_spec.rb index 8b54d72d6f7..a1079e54975 100644 --- a/spec/lib/gitlab/regex_spec.rb +++ b/spec/lib/gitlab/regex_spec.rb @@ -18,6 +18,7 @@ describe Gitlab::Regex do subject { described_class.environment_name_regex } it { is_expected.to match('foo') } + it { is_expected.to match('a') } it { is_expected.to match('foo-1') } it { is_expected.to match('FOO') } it { is_expected.to match('foo/1') } @@ -25,6 +26,10 @@ describe Gitlab::Regex do it { is_expected.not_to match('9&foo') } it { is_expected.not_to match('foo-^') } it { is_expected.not_to match('!!()()') } + it { is_expected.not_to match('/foo') } + it { is_expected.not_to match('foo/') } + it { is_expected.not_to match('/foo/') } + it { is_expected.not_to match('/') } end describe '.environment_slug_regex' do |