diff options
| author | Joern Schneeweisz <jschneeweisz@gitlab.com> | 2019-10-08 08:53:36 +0200 |
|---|---|---|
| committer | Joern Schneeweisz <jschneeweisz@gitlab.com> | 2019-10-08 08:53:36 +0200 |
| commit | e3c910927cfa072c24256136097e7a0b6ef241d6 (patch) | |
| tree | bbfad6f1301a2ddb95d39cbb2c8256618154b038 /spec | |
| parent | 7e2b1008547d8ced97a30e96ac6fbc2b7ad32a7f (diff) | |
| download | gitlab-ce-e3c910927cfa072c24256136097e7a0b6ef241d6.tar.gz | |
Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue.
Fixes https://dev.gitlab.org/gitlab/gitlabhq/issues/2934 and https://gitlab.com/gitlab-org/gitlab/issues/33569
Diffstat (limited to 'spec')
| -rw-r--r-- | spec/controllers/concerns/internal_redirect_spec.rb | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/spec/controllers/concerns/internal_redirect_spec.rb b/spec/controllers/concerns/internal_redirect_spec.rb index da68c8c8697..e5e50cfd55e 100644 --- a/spec/controllers/concerns/internal_redirect_spec.rb +++ b/spec/controllers/concerns/internal_redirect_spec.rb @@ -19,7 +19,8 @@ describe InternalRedirect do [ 'Hello world', '//example.com/hello/world', - 'https://example.com/hello/world' + 'https://example.com/hello/world', + "not-starting-with-a-slash\n/starting/with/slash" ] end |