diff options
| author | Rémy Coutable <remy@rymai.me> | 2018-12-10 12:03:01 +0000 |
|---|---|---|
| committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2018-12-11 19:49:36 +0000 |
| commit | b1ac474dc753d61e48e38e68cd7f5613ae6dda8b (patch) | |
| tree | 199136990392d0e6c269c0ea76f6d635d36a691c | |
| parent | 4619cbd253ad8b1d90d12d1b7f9cf15d70b3631d (diff) | |
| download | gitlab-ce-b1ac474dc753d61e48e38e68cd7f5613ae6dda8b.tar.gz | |
Merge branch 'sh-ignore-arrays-url-sanitizer' into 'master'
Only allow strings in URL::Sanitizer.valid?
Closes #55079
See merge request gitlab-org/gitlab-ce!23675
(cherry picked from commit 5c5a5992c0602f14c7f4f43b5fc2756662fafb3c)
401be1d1 Only allow strings in URL::Sanitizer.valid?
| -rw-r--r-- | changelogs/unreleased/sh-ignore-arrays-url-sanitizer.yml | 5 | ||||
| -rw-r--r-- | lib/gitlab/url_sanitizer.rb | 1 | ||||
| -rw-r--r-- | spec/lib/gitlab/url_sanitizer_spec.rb | 1 |
3 files changed, 7 insertions, 0 deletions
diff --git a/changelogs/unreleased/sh-ignore-arrays-url-sanitizer.yml b/changelogs/unreleased/sh-ignore-arrays-url-sanitizer.yml new file mode 100644 index 00000000000..c010bd1f540 --- /dev/null +++ b/changelogs/unreleased/sh-ignore-arrays-url-sanitizer.yml @@ -0,0 +1,5 @@ +--- +title: Only allow strings in URL::Sanitizer.valid? +merge_request: 23675 +author: +type: fixed diff --git a/lib/gitlab/url_sanitizer.rb b/lib/gitlab/url_sanitizer.rb index 035268bc4f2..880712de5fe 100644 --- a/lib/gitlab/url_sanitizer.rb +++ b/lib/gitlab/url_sanitizer.rb @@ -14,6 +14,7 @@ module Gitlab def self.valid?(url) return false unless url.present? + return false unless url.is_a?(String) uri = Addressable::URI.parse(url.strip) diff --git a/spec/lib/gitlab/url_sanitizer_spec.rb b/spec/lib/gitlab/url_sanitizer_spec.rb index b41a81a8167..6e98a999766 100644 --- a/spec/lib/gitlab/url_sanitizer_spec.rb +++ b/spec/lib/gitlab/url_sanitizer_spec.rb @@ -41,6 +41,7 @@ describe Gitlab::UrlSanitizer do false | '123://invalid:url' false | 'valid@project:url.git' false | 'valid:pass@project:url.git' + false | %w(test array) true | 'ssh://example.com' true | 'ssh://:@example.com' true | 'ssh://foo@example.com' |