diff options
| author | Robert Speicher <robert@gitlab.com> | 2018-01-05 21:36:18 +0000 |
|---|---|---|
| committer | Stan Hu <stanhu@gmail.com> | 2018-01-16 17:04:51 -0800 |
| commit | 791ca43f3f8f12451ee1e70efc90f5d82347af93 (patch) | |
| tree | 38408c69a00d1ec5de991a4698ce093b73545517 /app/services/web_hook_service.rb | |
| parent | 536a47b4b70df0f2a8438ed0ada7654593fa5cd0 (diff) | |
| download | gitlab-ce-791ca43f3f8f12451ee1e70efc90f5d82347af93.tar.gz | |
Merge branch '41293-fix-command-injection-vulnerability-on-system_hook_push-queue-through-web-hook' into 'security-10-3'
Don't allow line breaks on HTTP headers
See merge request gitlab/gitlabhq!2277
(cherry picked from commit 7fc0a6fc096768a5604d6dd24d7d952e53300c82)
073b8f9c Don't allow line breaks on HTTP headers
Diffstat (limited to 'app/services/web_hook_service.rb')
| -rw-r--r-- | app/services/web_hook_service.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/services/web_hook_service.rb b/app/services/web_hook_service.rb index 6ebc7c89500..36e589d5aa8 100644 --- a/app/services/web_hook_service.rb +++ b/app/services/web_hook_service.rb @@ -113,7 +113,7 @@ class WebHookService 'Content-Type' => 'application/json', 'X-Gitlab-Event' => hook_name.singularize.titleize }.tap do |hash| - hash['X-Gitlab-Token'] = hook.token if hook.token.present? + hash['X-Gitlab-Token'] = Gitlab::Utils.remove_line_breaks(hook.token) if hook.token.present? end end end |