diff options
author | Nick Thomas <nick@gitlab.com> | 2018-08-13 12:07:23 +0000 |
---|---|---|
committer | Jose Vargas <jvargas@gitlab.com> | 2018-08-24 15:07:17 -0500 |
commit | da80e899ec5a2a9b07b46162cbdb693ef4a13d59 (patch) | |
tree | 279bc6a8e8a8494525e38cf4e9b1a52416245a83 | |
parent | 4fe832271e99f2d56ddaf649ea53bed614019830 (diff) | |
download | gitlab-ce-da80e899ec5a2a9b07b46162cbdb693ef4a13d59.tar.gz |
Merge branch 'sh-block-link-local-master-11-0-port' into 'security-11-0'
Block link-local addresses in URLBlocker (11.0 port)
See merge request gitlab/gitlabhq!2462
-rw-r--r-- | changelogs/unreleased/sh-block-link-local-master.yml | 5 | ||||
-rw-r--r-- | lib/gitlab/url_blocker.rb | 8 | ||||
-rw-r--r-- | spec/lib/gitlab/url_blocker_spec.rb | 25 |
3 files changed, 37 insertions, 1 deletions
diff --git a/changelogs/unreleased/sh-block-link-local-master.yml b/changelogs/unreleased/sh-block-link-local-master.yml new file mode 100644 index 00000000000..0a6017479af --- /dev/null +++ b/changelogs/unreleased/sh-block-link-local-master.yml @@ -0,0 +1,5 @@ +--- +title: Block link-local addresses in URLBlocker +merge_request: +author: +type: security diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index 38be75b7482..3b483f27e70 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -31,6 +31,7 @@ module Gitlab validate_localhost!(addrs_info) unless allow_localhost validate_local_network!(addrs_info) unless allow_local_network + validate_link_local!(addrs_info) unless allow_local_network true end @@ -89,6 +90,13 @@ module Gitlab raise BlockedUrlError, "Requests to the local network are not allowed" end + def validate_link_local!(addrs_info) + netmask = IPAddr.new('169.254.0.0/16') + return unless addrs_info.any? { |addr| addr.ipv6_linklocal? || netmask.include?(addr.ip_address) } + + raise BlockedUrlError, "Requests to the link local network are not allowed" + end + def internal?(uri) internal_web?(uri) || internal_shell?(uri) end diff --git a/spec/lib/gitlab/url_blocker_spec.rb b/spec/lib/gitlab/url_blocker_spec.rb index 6f5f9938eca..624e2add860 100644 --- a/spec/lib/gitlab/url_blocker_spec.rb +++ b/spec/lib/gitlab/url_blocker_spec.rb @@ -1,3 +1,4 @@ +# coding: utf-8 require 'spec_helper' describe Gitlab::UrlBlocker do @@ -82,6 +83,17 @@ describe Gitlab::UrlBlocker do expect(described_class).not_to be_blocked_url("http://#{ip}") end end + + it 'allows IPv4 link-local endpoints' do + expect(described_class).not_to be_blocked_url('http://169.254.169.254') + expect(described_class).not_to be_blocked_url('http://169.254.168.100') + end + + # This is blocked due to the hostname check: https://gitlab.com/gitlab-org/gitlab-ce/issues/50227 + it 'blocks IPv6 link-local endpoints' do + expect(described_class).to be_blocked_url('http://[::ffff:169.254.169.254]') + expect(described_class).to be_blocked_url('http://[::ffff:169.254.168.100]') + end end context 'false' do @@ -96,10 +108,21 @@ describe Gitlab::UrlBlocker do expect(described_class).to be_blocked_url("http://#{ip}", allow_local_network: false) end end + + it 'blocks IPv4 link-local endpoints' do + expect(described_class).to be_blocked_url('http://169.254.169.254', allow_local_network: false) + expect(described_class).to be_blocked_url('http://169.254.168.100', allow_local_network: false) + end + + it 'blocks IPv6 link-local endpoints' do + expect(described_class).to be_blocked_url('http://[::ffff:169.254.169.254]', allow_local_network: false) + expect(described_class).to be_blocked_url('http://[::ffff:169.254.168.100]', allow_local_network: false) + expect(described_class).to be_blocked_url('http://[FE80::C800:EFF:FE74:8]', allow_local_network: false) + end end def stub_domain_resolv(domain, ip) - allow(Addrinfo).to receive(:getaddrinfo).with(domain, any_args).and_return([double(ip_address: ip, ipv4_private?: true)]) + allow(Addrinfo).to receive(:getaddrinfo).with(domain, any_args).and_return([double(ip_address: ip, ipv4_private?: true, ipv6_link_local?: false)]) end def unstub_domain_resolv |