diff options
| author | Cindy Pallares <cindy@gitlab.com> | 2018-12-06 18:38:43 +0000 |
|---|---|---|
| committer | Cindy Pallares <cindy@gitlab.com> | 2018-12-06 18:38:43 +0000 |
| commit | a50c777d958d6e0f5c4cfc02294a40da088ceabd (patch) | |
| tree | d3e5dc9ea02671ffa86f997175c17a05741ae952 /lib/gitlab/utils.rb | |
| parent | daca42ac648166ea90ad6eb87e912c0b8c852933 (diff) | |
| parent | 69645389e925a106f00fed555fde54c38f26816a (diff) | |
| download | gitlab-ce-a50c777d958d6e0f5c4cfc02294a40da088ceabd.tar.gz | |
Merge branch '54857-fix-templates-path-traversal' into 'master'
[master]: Prevent a path traversal attack on global file templates
Closes #2745
See merge request gitlab/gitlabhq!2677
Diffstat (limited to 'lib/gitlab/utils.rb')
| -rw-r--r-- | lib/gitlab/utils.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/lib/gitlab/utils.rb b/lib/gitlab/utils.rb index e0e8f598ba4..26fc56227a2 100644 --- a/lib/gitlab/utils.rb +++ b/lib/gitlab/utils.rb @@ -4,6 +4,15 @@ module Gitlab module Utils extend self + # Ensure that the relative path will not traverse outside the base directory + def check_path_traversal!(path) + raise StandardError.new("Invalid path") if path.start_with?("..#{File::SEPARATOR}") || + path.include?("#{File::SEPARATOR}..#{File::SEPARATOR}") || + path.end_with?("#{File::SEPARATOR}..") + + path + end + # Run system command without outputting to stdout. # # @param cmd [Array<String>] |