diff options
author | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2018-07-16 16:22:29 +0000 |
---|---|---|
committer | Alessio Caiazza <acaiazza@gitlab.com> | 2018-07-17 10:15:28 +0200 |
commit | 7df7b3beec8cd6cf581307d2270ff91be1c8a14a (patch) | |
tree | c3aeed5b76d6356c52ecb534e5d3610c549f1bd9 | |
parent | 03655698204656bd3d5b30dd940fbada8a2da5bd (diff) | |
download | gitlab-ce-7df7b3beec8cd6cf581307d2270ff91be1c8a14a.tar.gz |
Merge branch 'sh-fix-issue-49133-11-1-stable' into 'security-11-1'
Fix symlink vulnerability in project import
See merge request gitlab/gitlabhq!2435
-rw-r--r-- | changelogs/unreleased/sh-fix-issue-49133-11-1-stable.yml | 5 | ||||
-rw-r--r-- | lib/gitlab/import_export/file_importer.rb | 3 | ||||
-rw-r--r-- | spec/lib/gitlab/import_export/file_importer_spec.rb | 7 |
3 files changed, 14 insertions, 1 deletions
diff --git a/changelogs/unreleased/sh-fix-issue-49133-11-1-stable.yml b/changelogs/unreleased/sh-fix-issue-49133-11-1-stable.yml new file mode 100644 index 00000000000..847220d88b2 --- /dev/null +++ b/changelogs/unreleased/sh-fix-issue-49133-11-1-stable.yml @@ -0,0 +1,5 @@ +--- +title: Fix symlink vulnerability in project import +merge_request: +author: +type: security diff --git a/lib/gitlab/import_export/file_importer.rb b/lib/gitlab/import_export/file_importer.rb index 0f4c3498036..4c411f4847e 100644 --- a/lib/gitlab/import_export/file_importer.rb +++ b/lib/gitlab/import_export/file_importer.rb @@ -4,6 +4,7 @@ module Gitlab include Gitlab::ImportExport::CommandLineUtil MAX_RETRIES = 8 + IGNORED_FILENAMES = %w(. ..).freeze def self.import(*args) new(*args).import @@ -59,7 +60,7 @@ module Gitlab end def extracted_files - Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| f =~ %r{.*/\.{1,2}$} } + Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| IGNORED_FILENAMES.include?(File.basename(f)) } end end end diff --git a/spec/lib/gitlab/import_export/file_importer_spec.rb b/spec/lib/gitlab/import_export/file_importer_spec.rb index 58b9fb06cc5..265937f899e 100644 --- a/spec/lib/gitlab/import_export/file_importer_spec.rb +++ b/spec/lib/gitlab/import_export/file_importer_spec.rb @@ -7,6 +7,7 @@ describe Gitlab::ImportExport::FileImporter do let(:symlink_file) { "#{shared.export_path}/invalid.json" } let(:hidden_symlink_file) { "#{shared.export_path}/.hidden" } let(:subfolder_symlink_file) { "#{shared.export_path}/subfolder/invalid.json" } + let(:evil_symlink_file) { "#{shared.export_path}/.\nevil" } before do stub_const('Gitlab::ImportExport::FileImporter::MAX_RETRIES', 0) @@ -34,6 +35,10 @@ describe Gitlab::ImportExport::FileImporter do expect(File.exist?(hidden_symlink_file)).to be false end + it 'removes evil symlinks in root folder' do + expect(File.exist?(evil_symlink_file)).to be false + end + it 'removes symlinks in subfolders' do expect(File.exist?(subfolder_symlink_file)).to be false end @@ -75,5 +80,7 @@ describe Gitlab::ImportExport::FileImporter do FileUtils.touch(valid_file) FileUtils.ln_s(valid_file, symlink_file) FileUtils.ln_s(valid_file, subfolder_symlink_file) + FileUtils.ln_s(valid_file, hidden_symlink_file) + FileUtils.ln_s(valid_file, evil_symlink_file) end end |