diff options
author | Stan Hu <stanhu@gmail.com> | 2018-07-11 10:59:56 -0700 |
---|---|---|
committer | Alessio Caiazza <acaiazza@gitlab.com> | 2018-07-17 10:30:52 +0200 |
commit | eda8156e5c2b9bd026e7f56c0fa36e7cd7007df5 (patch) | |
tree | cd8ceb5649bb4b21288089a1b18639425ad552e9 | |
parent | 7f0431dd8550ac9d229d1383c03386c1634d015f (diff) | |
download | gitlab-ce-eda8156e5c2b9bd026e7f56c0fa36e7cd7007df5.tar.gz |
Fix symlink vulnerability in project import
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/49133
-rw-r--r-- | changelogs/unreleased/sh-fix-issue-49133.yml | 5 | ||||
-rw-r--r-- | lib/gitlab/import_export/file_importer.rb | 3 | ||||
-rw-r--r-- | spec/lib/gitlab/import_export/file_importer_spec.rb | 7 |
3 files changed, 14 insertions, 1 deletions
diff --git a/changelogs/unreleased/sh-fix-issue-49133.yml b/changelogs/unreleased/sh-fix-issue-49133.yml new file mode 100644 index 00000000000..847220d88b2 --- /dev/null +++ b/changelogs/unreleased/sh-fix-issue-49133.yml @@ -0,0 +1,5 @@ +--- +title: Fix symlink vulnerability in project import +merge_request: +author: +type: security diff --git a/lib/gitlab/import_export/file_importer.rb b/lib/gitlab/import_export/file_importer.rb index 0f4c3498036..de36adc1d5a 100644 --- a/lib/gitlab/import_export/file_importer.rb +++ b/lib/gitlab/import_export/file_importer.rb @@ -4,6 +4,7 @@ module Gitlab include Gitlab::ImportExport::CommandLineUtil MAX_RETRIES = 8 + WHITELISTED_FILENAMES = %w(. ..).freeze def self.import(*args) new(*args).import @@ -59,7 +60,7 @@ module Gitlab end def extracted_files - Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| f =~ %r{.*/\.{1,2}$} } + Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| WHITELISTED_FILENAMES.include?(File.basename(f)) } end end end diff --git a/spec/lib/gitlab/import_export/file_importer_spec.rb b/spec/lib/gitlab/import_export/file_importer_spec.rb index 58b9fb06cc5..265937f899e 100644 --- a/spec/lib/gitlab/import_export/file_importer_spec.rb +++ b/spec/lib/gitlab/import_export/file_importer_spec.rb @@ -7,6 +7,7 @@ describe Gitlab::ImportExport::FileImporter do let(:symlink_file) { "#{shared.export_path}/invalid.json" } let(:hidden_symlink_file) { "#{shared.export_path}/.hidden" } let(:subfolder_symlink_file) { "#{shared.export_path}/subfolder/invalid.json" } + let(:evil_symlink_file) { "#{shared.export_path}/.\nevil" } before do stub_const('Gitlab::ImportExport::FileImporter::MAX_RETRIES', 0) @@ -34,6 +35,10 @@ describe Gitlab::ImportExport::FileImporter do expect(File.exist?(hidden_symlink_file)).to be false end + it 'removes evil symlinks in root folder' do + expect(File.exist?(evil_symlink_file)).to be false + end + it 'removes symlinks in subfolders' do expect(File.exist?(subfolder_symlink_file)).to be false end @@ -75,5 +80,7 @@ describe Gitlab::ImportExport::FileImporter do FileUtils.touch(valid_file) FileUtils.ln_s(valid_file, symlink_file) FileUtils.ln_s(valid_file, subfolder_symlink_file) + FileUtils.ln_s(valid_file, hidden_symlink_file) + FileUtils.ln_s(valid_file, evil_symlink_file) end end |