diff options
author | John Jarvis <jarv@gitlab.com> | 2019-01-01 20:38:37 +0000 |
---|---|---|
committer | John Jarvis <jarv@gitlab.com> | 2019-01-01 20:38:37 +0000 |
commit | e4dabec82a8f375389b9bb52b8fe6b1ac304d74e (patch) | |
tree | aaa221a679fd83fd7f41478e50a23ded4bc08fd4 /spec/models/project_spec.rb | |
parent | 8f461ef779187018ddac59dbaccafe01c493e463 (diff) | |
parent | 63c48f73803cf1c68d6c9af408f877ea61781118 (diff) | |
download | gitlab-ce-e4dabec82a8f375389b9bb52b8fe6b1ac304d74e.tar.gz |
Merge branch 'security-fix-ssrf-import-url-remote-mirror' into 'master'
[master] SSRF - Scan Internal Ports and GCP/AWS endpoints
See merge request gitlab/gitlabhq!2689
Diffstat (limited to 'spec/models/project_spec.rb')
-rw-r--r-- | spec/models/project_spec.rb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb index a01f76a5bab..4b86c6a1836 100644 --- a/spec/models/project_spec.rb +++ b/spec/models/project_spec.rb @@ -299,6 +299,13 @@ describe Project do expect(project.errors[:import_url].first).to include('Requests to localhost are not allowed') end + it 'does not allow import_url pointing to the local network' do + project = build(:project, import_url: 'https://192.168.1.1') + + expect(project).to be_invalid + expect(project.errors[:import_url].first).to include('Requests to the local network are not allowed') + end + it "does not allow import_url with invalid ports for new projects" do project = build(:project, import_url: 'http://github.com:25/t.git') |