diff options
author | Sean McGivern <sean@gitlab.com> | 2017-04-05 21:17:49 +0000 |
---|---|---|
committer | DJ Mountney <david@twkie.net> | 2017-04-05 21:07:26 -0700 |
commit | d687f6436a14c8b36f1a560ee95222bb2d4fb63f (patch) | |
tree | c55f23c41b4afcf9590fd056c33a0c367fd40fc2 | |
parent | b80653bb6aa8518e0a61e85cae4430928078c092 (diff) | |
download | gitlab-ce-d687f6436a14c8b36f1a560ee95222bb2d4fb63f.tar.gz |
Merge branch 'open-redirect-fix-continue-to' into 'security'
Fix for open redirect vuln involving continue[to] params
See merge request !2083
-rw-r--r-- | app/controllers/concerns/continue_params.rb | 1 | ||||
-rw-r--r-- | changelogs/unreleased/open-redirect-continue-params.yml | 4 | ||||
-rw-r--r-- | spec/controllers/projects/imports_controller_spec.rb | 9 |
3 files changed, 13 insertions, 1 deletions
diff --git a/app/controllers/concerns/continue_params.rb b/app/controllers/concerns/continue_params.rb index 0a995c45bdf..eb3a623acdd 100644 --- a/app/controllers/concerns/continue_params.rb +++ b/app/controllers/concerns/continue_params.rb @@ -7,6 +7,7 @@ module ContinueParams continue_params = continue_params.permit(:to, :notice, :notice_now) return unless continue_params[:to] && continue_params[:to].start_with?('/') + return if continue_params[:to].start_with?('//') continue_params end diff --git a/changelogs/unreleased/open-redirect-continue-params.yml b/changelogs/unreleased/open-redirect-continue-params.yml new file mode 100644 index 00000000000..def3bc7d929 --- /dev/null +++ b/changelogs/unreleased/open-redirect-continue-params.yml @@ -0,0 +1,4 @@ +--- +title: Fix for open redirect vulnerability using continue[to] in URL when requesting project import status. +merge_request: +author: diff --git a/spec/controllers/projects/imports_controller_spec.rb b/spec/controllers/projects/imports_controller_spec.rb index 7c75815f3c4..6724b474179 100644 --- a/spec/controllers/projects/imports_controller_spec.rb +++ b/spec/controllers/projects/imports_controller_spec.rb @@ -96,12 +96,19 @@ describe Projects::ImportsController do } end - it 'redirects to params[:to]' do + it 'redirects to internal params[:to]' do get :show, namespace_id: project.namespace.to_param, project_id: project, continue: params expect(flash[:notice]).to eq params[:notice] expect(response).to redirect_to params[:to] end + + it 'does not redirect to external params[:to]' do + params[:to] = "//google.com" + + get :show, namespace_id: project.namespace.to_param, project_id: project, continue: params + expect(response).not_to redirect_to params[:to] + end end end |