diff options
author | Robert Speicher <robert@gitlab.com> | 2018-01-05 21:36:18 +0000 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2018-01-16 17:04:51 -0800 |
commit | 791ca43f3f8f12451ee1e70efc90f5d82347af93 (patch) | |
tree | 38408c69a00d1ec5de991a4698ce093b73545517 /spec/models/hooks | |
parent | 536a47b4b70df0f2a8438ed0ada7654593fa5cd0 (diff) | |
download | gitlab-ce-791ca43f3f8f12451ee1e70efc90f5d82347af93.tar.gz |
Merge branch '41293-fix-command-injection-vulnerability-on-system_hook_push-queue-through-web-hook' into 'security-10-3'
Don't allow line breaks on HTTP headers
See merge request gitlab/gitlabhq!2277
(cherry picked from commit 7fc0a6fc096768a5604d6dd24d7d952e53300c82)
073b8f9c Don't allow line breaks on HTTP headers
Diffstat (limited to 'spec/models/hooks')
-rw-r--r-- | spec/models/hooks/web_hook_spec.rb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/spec/models/hooks/web_hook_spec.rb b/spec/models/hooks/web_hook_spec.rb index 388120160ab..ea6d6e53ef5 100644 --- a/spec/models/hooks/web_hook_spec.rb +++ b/spec/models/hooks/web_hook_spec.rb @@ -29,6 +29,12 @@ describe WebHook do expect(hook.url).to eq('https://example.com') end end + + describe 'token' do + it { is_expected.to allow_value("foobar").for(:token) } + + it { is_expected.not_to allow_values("foo\nbar", "foo\r\nbar").for(:token) } + end end describe 'execute' do |