diff options
| author | Douwe Maan <douwe@gitlab.com> | 2017-11-07 08:30:38 +0000 |
|---|---|---|
| committer | Michael Kozono <mkozono@gmail.com> | 2017-11-08 20:11:08 -0800 |
| commit | 89bd78352e4c575a0293f9c431dd677d288d28d2 (patch) | |
| tree | 1ec451574f05fd8b30371f54b7dc85ebf01d56df /lib | |
| parent | 0c3877a48827b587b407174410196993bec79f73 (diff) | |
| download | gitlab-ce-89bd78352e4c575a0293f9c431dd677d288d28d2.tar.gz | |
Merge branch 'ssrf-protections-round-2' into 'security-10-1'
Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions
See merge request gitlab/gitlabhq!2219
(cherry picked from commit 4a1e73783d5480aa514db7b53e10c075f95580b5)
1bffa0c3 Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/gitlab/url_blocker.rb | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index fee1a127fd7..13150ddab67 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -22,10 +22,12 @@ module Gitlab return true if blocked_user_or_hostname?(uri.user) return true if blocked_user_or_hostname?(uri.hostname) - server_ips = Resolv.getaddresses(uri.hostname) + server_ips = Addrinfo.getaddrinfo(uri.hostname, 80, nil, :STREAM).map(&:ip_address) return true if (blocked_ips & server_ips).any? rescue Addressable::URI::InvalidURIError return true + rescue SocketError + return false end false |