diff options
author | Robert Speicher <rspeicher@gmail.com> | 2019-06-03 17:01:25 +0000 |
---|---|---|
committer | Robert Speicher <rspeicher@gmail.com> | 2019-06-03 17:01:25 +0000 |
commit | 5906fb2e45f352b8fc02f0e98a6148d0c0b2db59 (patch) | |
tree | 98556faf9c2817d31098ef50e8641488e5969813 /lib/banzai | |
parent | 2b13462ac4f091a56c538042712dcf736bb50474 (diff) | |
parent | a76fdcb7a30c6244ffb11a2e672e16d1e5b413b2 (diff) | |
download | gitlab-ce-5906fb2e45f352b8fc02f0e98a6148d0c0b2db59.tar.gz |
Merge branch 'security-60143-address-xss-issue-master' into 'master'
Reject slug+uri concat if slug is deemed unsafe
See merge request gitlab/gitlabhq!3108
Diffstat (limited to 'lib/banzai')
-rw-r--r-- | lib/banzai/filter/wiki_link_filter/rewriter.rb | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/lib/banzai/filter/wiki_link_filter/rewriter.rb b/lib/banzai/filter/wiki_link_filter/rewriter.rb index f4cc8beeb52..77b5053f38c 100644 --- a/lib/banzai/filter/wiki_link_filter/rewriter.rb +++ b/lib/banzai/filter/wiki_link_filter/rewriter.rb @@ -4,6 +4,8 @@ module Banzai module Filter class WikiLinkFilter < HTML::Pipeline::Filter class Rewriter + UNSAFE_SLUG_REGEXES = [/\Ajavascript:/i].freeze + def initialize(link_string, wiki:, slug:) @uri = Addressable::URI.parse(link_string) @wiki_base_path = wiki && wiki.wiki_base_path @@ -35,6 +37,8 @@ module Banzai # Of the form `./link`, `../link`, or similar def apply_hierarchical_link_rules! + return if slug_considered_unsafe? + @uri = Addressable::URI.join(@slug, @uri) if @uri.to_s[0] == '.' end @@ -54,6 +58,10 @@ module Banzai def repository_upload? @uri.relative? && @uri.path.starts_with?(Wikis::CreateAttachmentService::ATTACHMENT_PATH) end + + def slug_considered_unsafe? + UNSAFE_SLUG_REGEXES.any? { |r| r.match?(@slug) } + end end end end |