10 files changed, 48 insertions, 2 deletions

diff --git a/app/controllers/import/base_controller.rb b/app/controllers/import/base_controller.rb
index 5766c6924cd..042b6b1264f 100644
--- a/app/controllers/import/base_controller.rb
+++ b/app/controllers/import/base_controller.rb
@@ -1,16 +1,22 @@
+# frozen_string_literal: true
+
 class Import::BaseController < ApplicationController
   private
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def find_already_added_projects(import_type)
     current_user.created_projects.where(import_type: import_type).includes(:import_state)
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def find_jobs(import_type)
     current_user.created_projects
       .includes(:import_state)
       .where(import_type: import_type)
       .to_json(only: [:id], methods: [:import_status])
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def find_or_create_namespace(names, owner)
     names = params[:target_namespace].presence || names
diff --git a/app/controllers/import/bitbucket_controller.rb b/app/controllers/import/bitbucket_controller.rb
index fa31933e778..1b30b4dda36 100644
--- a/app/controllers/import/bitbucket_controller.rb
+++ b/app/controllers/import/bitbucket_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::BitbucketController < Import::BaseController
   before_action :verify_bitbucket_import_enabled
   before_action :bitbucket_auth, except: :callback
@@ -16,6 +18,7 @@ class Import::BitbucketController < Import::BaseController
     redirect_to status_import_bitbucket_url
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def status
     bitbucket_client = Bitbucket::Client.new(credentials)
     repos = bitbucket_client.repos
@@ -27,6 +30,7 @@ class Import::BitbucketController < Import::BaseController
 
     @repos.to_a.reject! { |repo| already_added_projects_names.include?(repo.full_name) }
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def jobs
     render json: find_jobs('bitbucket')
diff --git a/app/controllers/import/bitbucket_server_controller.rb b/app/controllers/import/bitbucket_server_controller.rb
index 798daeca6c9..fdd1078cdf7 100644
--- a/app/controllers/import/bitbucket_server_controller.rb
+++ b/app/controllers/import/bitbucket_server_controller.rb
@@ -52,6 +52,7 @@ class Import::BitbucketServerController < Import::BaseController
     redirect_to status_import_bitbucket_server_path
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def status
     repos = bitbucket_client.repos
 
@@ -66,6 +67,7 @@ class Import::BitbucketServerController < Import::BaseController
     clear_session_data
     redirect_to new_import_bitbucket_server_path
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def jobs
     render json: find_jobs('bitbucket_server')
diff --git a/app/controllers/import/fogbugz_controller.rb b/app/controllers/import/fogbugz_controller.rb
index 2d665e05ac3..5a439e6de78 100644
--- a/app/controllers/import/fogbugz_controller.rb
+++ b/app/controllers/import/fogbugz_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::FogbugzController < Import::BaseController
   before_action :verify_fogbugz_import_enabled
   before_action :user_map, only: [:new_user_map, :create_user_map]
@@ -39,6 +41,7 @@ class Import::FogbugzController < Import::BaseController
     redirect_to status_import_fogbugz_path
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def status
     unless client.valid?
       return redirect_to new_import_fogbugz_path
@@ -51,6 +54,7 @@ class Import::FogbugzController < Import::BaseController
 
     @repos.reject! { |repo| already_added_projects_names.include? repo.name }
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def jobs
     render json: find_jobs('fogbugz')
diff --git a/app/controllers/import/gitea_controller.rb b/app/controllers/import/gitea_controller.rb
index fbd851c64a7..382c684a408 100644
--- a/app/controllers/import/gitea_controller.rb
+++ b/app/controllers/import/gitea_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::GiteaController < Import::GithubController
   def new
     if session[access_token_key].present? && session[host_key].present?
diff --git a/app/controllers/import/github_controller.rb b/app/controllers/import/github_controller.rb
index c9870332c0f..1dfa814cdd5 100644
--- a/app/controllers/import/github_controller.rb
+++ b/app/controllers/import/github_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::GithubController < Import::BaseController
   before_action :verify_import_enabled
   before_action :provider_auth, only: [:status, :jobs, :create]
@@ -22,6 +24,7 @@ class Import::GithubController < Import::BaseController
     redirect_to status_import_url
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def status
     @repos = client.repos
     @already_added_projects = find_already_added_projects(provider)
@@ -29,6 +32,7 @@ class Import::GithubController < Import::BaseController
 
     @repos.reject! { |repo| already_added_projects_names.include? repo.full_name }
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def jobs
     render json: find_jobs(provider)
@@ -104,9 +108,11 @@ class Import::GithubController < Import::BaseController
     :github
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def logged_in_with_provider?
     current_user.identities.exists?(provider: provider)
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def provider_auth
     if session[access_token_key].blank?
diff --git a/app/controllers/import/gitlab_controller.rb b/app/controllers/import/gitlab_controller.rb
index 53f70446d95..498de0b07b8 100644
--- a/app/controllers/import/gitlab_controller.rb
+++ b/app/controllers/import/gitlab_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::GitlabController < Import::BaseController
   MAX_PROJECT_PAGES = 15
   PER_PAGE_PROJECTS = 100
@@ -12,6 +14,7 @@ class Import::GitlabController < Import::BaseController
     redirect_to status_import_gitlab_url
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def status
     @repos = client.projects(starting_page: 1, page_limit: MAX_PROJECT_PAGES, per_page: PER_PAGE_PROJECTS)
 
@@ -20,6 +23,7 @@ class Import::GitlabController < Import::BaseController
 
     @repos = @repos.to_a.reject { |repo| already_added_projects_names.include? repo["path_with_namespace"] }
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def jobs
     render json: find_jobs('gitlab')
diff --git a/app/controllers/import/gitlab_projects_controller.rb b/app/controllers/import/gitlab_projects_controller.rb
index f22df992fe9..354fba5d204 100644
--- a/app/controllers/import/gitlab_projects_controller.rb
+++ b/app/controllers/import/gitlab_projects_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::GitlabProjectsController < Import::BaseController
   before_action :whitelist_query_limiting, only: [:create]
   before_action :verify_gitlab_project_import_enabled
@@ -11,7 +13,7 @@ class Import::GitlabProjectsController < Import::BaseController
 
   def create
     unless file_is_valid?
-      return redirect_back_or_default(options: { alert: "You need to upload a GitLab project export archive." })
+      return redirect_back_or_default(options: { alert: "You need to upload a GitLab project export archive (ending in .gz)." })
     end
 
     @project = ::Projects::GitlabProjectsImportService.new(current_user, project_params).execute
@@ -29,7 +31,11 @@ class Import::GitlabProjectsController < Import::BaseController
   private
 
   def file_is_valid?
-    project_params[:file] && project_params[:file].respond_to?(:read)
+    return false unless project_params[:file] && project_params[:file].respond_to?(:read)
+
+    filename = project_params[:file].original_filename
+
+    ImportExportUploader::EXTENSION_WHITELIST.include?(File.extname(filename).delete('.'))
   end
 
   def verify_gitlab_project_import_enabled
diff --git a/app/controllers/import/google_code_controller.rb b/app/controllers/import/google_code_controller.rb
index 3bce27e810a..331f06c3dd6 100644
--- a/app/controllers/import/google_code_controller.rb
+++ b/app/controllers/import/google_code_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::GoogleCodeController < Import::BaseController
   before_action :verify_google_code_import_enabled
   before_action :user_map, only: [:new_user_map, :create_user_map]
@@ -65,6 +67,7 @@ class Import::GoogleCodeController < Import::BaseController
     redirect_to status_import_google_code_path
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def status
     unless client.valid?
       return redirect_to new_import_google_code_path
@@ -78,6 +81,7 @@ class Import::GoogleCodeController < Import::BaseController
 
     @repos.reject! { |repo| already_added_projects_names.include? repo.name }
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def jobs
     render json: find_jobs('google_code')
diff --git a/app/controllers/import/manifest_controller.rb b/app/controllers/import/manifest_controller.rb
index e5a719fa0df..320cd45b925 100644
--- a/app/controllers/import/manifest_controller.rb
+++ b/app/controllers/import/manifest_controller.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Import::ManifestController < Import::BaseController
   before_action :whitelist_query_limiting, only: [:create]
   before_action :verify_import_enabled
@@ -6,6 +8,7 @@ class Import::ManifestController < Import::BaseController
   def new
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def status
     @already_added_projects = find_already_added_projects
     already_added_import_urls = @already_added_projects.pluck(:import_url)
@@ -14,6 +17,7 @@ class Import::ManifestController < Import::BaseController
       already_added_import_urls.include?(repository[:url])
     end
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def upload
     group = Group.find(params[:group_id])
@@ -64,9 +68,11 @@ class Import::ManifestController < Import::BaseController
     end
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def group
     @group ||= Group.find_by(id: session[:manifest_import_group_id])
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def repositories
     @repositories ||= session[:manifest_import_repositories]
@@ -76,12 +82,14 @@ class Import::ManifestController < Import::BaseController
     find_already_added_projects.to_json(only: [:id], methods: [:import_status])
   end
 
+  # rubocop: disable CodeReuse/ActiveRecord
   def find_already_added_projects
     group.all_projects
       .where(import_type: 'manifest')
       .where(creator_id: current_user)
       .includes(:import_state)
   end
+  # rubocop: enable CodeReuse/ActiveRecord
 
   def verify_import_enabled
     render_404 unless manifest_import_enabled?