diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-10-24 18:53:09 +0000 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-10-24 18:53:09 +0000 |
commit | d6d133a53e9658e65342fe48b1dbdb5e130d5bcf (patch) | |
tree | 319695367753d694eb63864e87d1ae2fb0f50c31 /app | |
parent | b81db02d4235802218521314c3ee2ca65bb591bd (diff) | |
parent | 1976f7b2e970f30d72dbe4cfa6a8cdd769b2f62b (diff) | |
download | gitlab-ce-d6d133a53e9658e65342fe48b1dbdb5e130d5bcf.tar.gz |
Merge branch 'security-open-redirect-internalredirect-12-3' into '12-3-stable'
Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue.
See merge request gitlab/gitlabhq!3475
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/concerns/internal_redirect.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/controllers/concerns/internal_redirect.rb b/app/controllers/concerns/internal_redirect.rb index 99bbfd56516..a35bc19aa37 100644 --- a/app/controllers/concerns/internal_redirect.rb +++ b/app/controllers/concerns/internal_redirect.rb @@ -6,7 +6,7 @@ module InternalRedirect def safe_redirect_path(path) return unless path # Verify that the string starts with a `/` and a known route character. - return unless path =~ %r{^/[-\w].*$} + return unless path =~ %r{\A/[-\w].*\z} uri = URI(path) # Ignore anything path of the redirect except for the path, querystring and, |