diff options
Diffstat (limited to 'doc/development/shell_commands.md')
| -rw-r--r-- | doc/development/shell_commands.md | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/doc/development/shell_commands.md b/doc/development/shell_commands.md index 73893f9dd46..7bdf676be58 100644 --- a/doc/development/shell_commands.md +++ b/doc/development/shell_commands.md @@ -190,7 +190,7 @@ A check like this could have avoided CVE-2013-4583. ## Properly anchor regular expressions to the start and end of strings -When using regular expressions to validate user input that is passed as an argument to a shell command, make sure to use the `\A` and `\z` anchors that designate the start and end of the string, rather than `^` and `$`, or no anchors at all. +When using regular expressions to validate user input that is passed as an argument to a shell command, make sure to use the `\A` and `\z` anchors that designate the start and end of the string, rather than `^` and `$`, or no anchors at all. If you don't, an attacker could use this to execute commands with potentially harmful effect. @@ -198,7 +198,7 @@ For example, when a project's `import_url` is validated like below, the user cou ```ruby validates :import_url, format: { with: URI.regexp(%w(ssh git http https)) } -# URI.regexp(%w(ssh git http https)) roughly evaluates to /(ssh|git|http|https):(something_that_looks_like_a_url)/ +# URI.regexp(%w(ssh git http https)) roughly evaluates to /(ssh|git|http|https):(something_that_looks_like_a_url)/ ``` Suppose the user submits the following as their import URL: @@ -211,7 +211,6 @@ Since there are no anchors in the used regular expression, the `git:/tmp/lol` in When importing, GitLab would execute the following command, passing the `import_url` as an argument: - ```sh git clone file://git:/tmp/lol ``` |