diff options
author | Steve Azzopardi <sazzopardi@gitlab.com> | 2018-11-26 08:45:38 +0000 |
---|---|---|
committer | Steve Azzopardi <sazzopardi@gitlab.com> | 2018-11-26 08:45:38 +0000 |
commit | 20c83d5c904842dcb4c1487b1f4b186f63fcee29 (patch) | |
tree | 141d36c18d04862ad08a565253fca925e08f82dd /lib | |
parent | 2f668e408d804d56275f2c85f447b539b3f844a4 (diff) | |
parent | 9074f5bb466a1b6f4ad12e270c63d3f4c2b0abcc (diff) | |
download | gitlab-ce-20c83d5c904842dcb4c1487b1f4b186f63fcee29.tar.gz |
Merge branch 'security-11-5-fix-webhook-ssrf-ipv6' into 'security-11-5'
[11.5] Fix SSRF in project integrations
See merge request gitlab/gitlabhq!2611
Diffstat (limited to 'lib')
-rw-r--r-- | lib/gitlab/url_blocker.rb | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index 4b1b58d68d8..8f0f9f9d92a 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -1,6 +1,7 @@ # frozen_string_literal: true require 'resolv' +require 'ipaddress' module Gitlab class UrlBlocker @@ -26,7 +27,9 @@ module Gitlab validate_hostname!(uri.hostname) begin - addrs_info = Addrinfo.getaddrinfo(uri.hostname, port, nil, :STREAM) + addrs_info = Addrinfo.getaddrinfo(uri.hostname, port, nil, :STREAM).map do |addr| + addr.ipv6_v4mapped? ? addr.ipv6_to_ipv4 : addr + end rescue SocketError return true end @@ -73,13 +76,14 @@ module Gitlab def validate_hostname!(value) return if value.blank? + return if IPAddress.valid?(value) return if value =~ /\A\p{Alnum}/ - raise BlockedUrlError, "Hostname needs to start with an alphanumeric character" + raise BlockedUrlError, "Hostname or IP address invalid" end def validate_localhost!(addrs_info) - local_ips = ["127.0.0.1", "::1", "0.0.0.0"] + local_ips = ["::", "0.0.0.0"] local_ips.concat(Socket.ip_address_list.map(&:ip_address)) return if (local_ips & addrs_info.map(&:ip_address)).empty? @@ -94,7 +98,7 @@ module Gitlab end def validate_local_network!(addrs_info) - return unless addrs_info.any? { |addr| addr.ipv4_private? || addr.ipv6_sitelocal? } + return unless addrs_info.any? { |addr| addr.ipv4_private? || addr.ipv6_sitelocal? || addr.ipv6_unique_local? } raise BlockedUrlError, "Requests to the local network are not allowed" end |