diff options
author | Stan Hu <stanhu@gmail.com> | 2018-08-11 03:38:21 -0700 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2018-08-12 22:34:34 -0700 |
commit | b3f755875046608e8b1f84fa1a1fc46689f6eda3 (patch) | |
tree | e1bba1fd5481dd32384817d035c8e960ea5bec85 /lib/gitlab/url_blocker.rb | |
parent | 197a305b845246c5a39266a64c167169f09ac787 (diff) | |
download | gitlab-ce-b3f755875046608e8b1f84fa1a1fc46689f6eda3.tar.gz |
Block link-local addresses in URLBlocker
Closes https://gitlab.com/gitlab-com/migration/issues/766
Diffstat (limited to 'lib/gitlab/url_blocker.rb')
-rw-r--r-- | lib/gitlab/url_blocker.rb | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index 38be75b7482..3b483f27e70 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -31,6 +31,7 @@ module Gitlab validate_localhost!(addrs_info) unless allow_localhost validate_local_network!(addrs_info) unless allow_local_network + validate_link_local!(addrs_info) unless allow_local_network true end @@ -89,6 +90,13 @@ module Gitlab raise BlockedUrlError, "Requests to the local network are not allowed" end + def validate_link_local!(addrs_info) + netmask = IPAddr.new('169.254.0.0/16') + return unless addrs_info.any? { |addr| addr.ipv6_linklocal? || netmask.include?(addr.ip_address) } + + raise BlockedUrlError, "Requests to the link local network are not allowed" + end + def internal?(uri) internal_web?(uri) || internal_shell?(uri) end |