diff options
| author | Douwe Maan <douwe@gitlab.com> | 2016-10-27 15:10:19 +0000 |
|---|---|---|
| committer | Rémy Coutable <remy@rymai.me> | 2016-11-03 16:04:18 +0100 |
| commit | dc9b3db8b0e278399c5ce4ff9b0c5e388ecfe5b0 (patch) | |
| tree | 21342674480918dd297a8a05f6dc511ff57783be /lib/gitlab/import_export/project_tree_restorer.rb | |
| parent | cfb511ea692fedffbad5b6ee1a7638b1eb78a4d6 (diff) | |
| download | gitlab-ce-dc9b3db8b0e278399c5ce4ff9b0c5e388ecfe5b0.tar.gz | |
Merge branch 'fix/import-export-symlink-vulnerability' into 'security'
Fix symlink vulnerability in Import/Export
Replaces https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2018 made by @james
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23822
See merge request !2022
Signed-off-by: Rémy Coutable <remy@rymai.me>
Diffstat (limited to 'lib/gitlab/import_export/project_tree_restorer.rb')
| -rw-r--r-- | lib/gitlab/import_export/project_tree_restorer.rb | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/lib/gitlab/import_export/project_tree_restorer.rb b/lib/gitlab/import_export/project_tree_restorer.rb index 7cdba880a93..c551321c18d 100644 --- a/lib/gitlab/import_export/project_tree_restorer.rb +++ b/lib/gitlab/import_export/project_tree_restorer.rb @@ -9,8 +9,14 @@ module Gitlab end def restore - json = IO.read(@path) - @tree_hash = ActiveSupport::JSON.decode(json) + begin + json = IO.read(@path) + @tree_hash = ActiveSupport::JSON.decode(json) + rescue => e + Rails.logger.error("Import/Export error: #{e.message}") + raise Gitlab::ImportExport::Error.new('Incorrect JSON format') + end + @project_members = @tree_hash.delete('project_members') ActiveRecord::Base.no_touching do |