diff options
author | Mike Greiling <mgreiling@gitlab.com> | 2017-08-08 22:21:41 +0000 |
---|---|---|
committer | Mike Greiling <mike@pixelcog.com> | 2017-08-08 17:39:54 -0500 |
commit | c6c869cf9d6d1f61771aa31354bbc8fdf31f189b (patch) | |
tree | 687a14b80bc3a6d3b7a64fbbf264d2f8f7dbf0db | |
parent | bd967a190d5293c4b332133617af847b5c28d125 (diff) | |
download | gitlab-ce-c6c869cf9d6d1f61771aa31354bbc8fdf31f189b.tar.gz |
Merge branch 'import-symlinks-9-1' into 'security-9-1'
Fix file disclosure via hidden symlinks using the project import (9.1)
See merge request !2162
-rw-r--r-- | changelogs/unreleased/fix-import-symbolink-links.yml | 4 | ||||
-rw-r--r-- | lib/gitlab/import_export/file_importer.rb | 6 | ||||
-rw-r--r-- | spec/lib/gitlab/import_export/file_importer_spec.rb | 5 |
3 files changed, 14 insertions, 1 deletions
diff --git a/changelogs/unreleased/fix-import-symbolink-links.yml b/changelogs/unreleased/fix-import-symbolink-links.yml new file mode 100644 index 00000000000..36e73821bdc --- /dev/null +++ b/changelogs/unreleased/fix-import-symbolink-links.yml @@ -0,0 +1,4 @@ +--- +title: Remove hidden symlinks from project import files +merge_request: +author: diff --git a/lib/gitlab/import_export/file_importer.rb b/lib/gitlab/import_export/file_importer.rb index ffd17118c91..989342389bc 100644 --- a/lib/gitlab/import_export/file_importer.rb +++ b/lib/gitlab/import_export/file_importer.rb @@ -47,12 +47,16 @@ module Gitlab end def remove_symlinks! - Dir["#{@shared.export_path}/**/*"].each do |path| + extracted_files.each do |path| FileUtils.rm(path) if File.lstat(path).symlink? end true end + + def extracted_files + Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| f =~ /.*\/\.{1,2}$/ } + end end end end diff --git a/spec/lib/gitlab/import_export/file_importer_spec.rb b/spec/lib/gitlab/import_export/file_importer_spec.rb index b88b9c18c15..2be73ae415f 100644 --- a/spec/lib/gitlab/import_export/file_importer_spec.rb +++ b/spec/lib/gitlab/import_export/file_importer_spec.rb @@ -5,6 +5,7 @@ describe Gitlab::ImportExport::FileImporter, lib: true do let(:export_path) { "#{Dir.tmpdir}/file_importer_spec" } let(:valid_file) { "#{shared.export_path}/valid.json" } let(:symlink_file) { "#{shared.export_path}/invalid.json" } + let(:hidden_symlink_file) { "#{shared.export_path}/.hidden" } let(:subfolder_symlink_file) { "#{shared.export_path}/subfolder/invalid.json" } before do @@ -25,6 +26,10 @@ describe Gitlab::ImportExport::FileImporter, lib: true do expect(File.exist?(symlink_file)).to be false end + it 'removes hidden symlinks in root folder' do + expect(File.exist?(hidden_symlink_file)).to be false + end + it 'removes symlinks in subfolders' do expect(File.exist?(subfolder_symlink_file)).to be false end |