diff options
| author | Nick Thomas <nick@gitlab.com> | 2018-12-04 15:59:01 +0000 |
|---|---|---|
| committer | Nick Thomas <nick@gitlab.com> | 2018-12-05 14:12:35 +0000 |
| commit | 69645389e925a106f00fed555fde54c38f26816a (patch) | |
| tree | baf7b8dd019934e8bf9d113566b4497d64c61437 /lib/gitlab/utils.rb | |
| parent | 87186cbc922465875e299ed761ed4d6143ae501a (diff) | |
| download | gitlab-ce-69645389e925a106f00fed555fde54c38f26816a.tar.gz | |
Prevent a path traversal attack on global file templates
The API permits path traversal characters like '../' to be passed down
to the template finder. Detect these requests and cause them to fail
with a 500 response code.
Diffstat (limited to 'lib/gitlab/utils.rb')
| -rw-r--r-- | lib/gitlab/utils.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/lib/gitlab/utils.rb b/lib/gitlab/utils.rb index 9e59137a2c0..263a2fffdbe 100644 --- a/lib/gitlab/utils.rb +++ b/lib/gitlab/utils.rb @@ -4,6 +4,15 @@ module Gitlab module Utils extend self + # Ensure that the relative path will not traverse outside the base directory + def check_path_traversal!(path) + raise StandardError.new("Invalid path") if path.start_with?("..#{File::SEPARATOR}") || + path.include?("#{File::SEPARATOR}..#{File::SEPARATOR}") || + path.end_with?("#{File::SEPARATOR}..") + + path + end + # Run system command without outputting to stdout. # # @param cmd [Array<String>] |