1 files changed, 23 insertions, 1 deletions
diff --git a/lib/gitlab/changelog/config.rb b/lib/gitlab/changelog/config.rb
index 105050936ce..be8009750da 100644
--- a/lib/gitlab/changelog/config.rb
+++ b/lib/gitlab/changelog/config.rb
@@ -17,7 +17,24 @@ module Gitlab
       # The default template to use for generating release sections.
       DEFAULT_TEMPLATE = File.read(File.join(__dir__, 'template.tpl'))
 
-      attr_accessor :date_format, :categories, :template
+      # The regex to use for extracting the version from a Git tag.
+      #
+      # This regex is based on the official semantic versioning regex (as found
+      # on https://semver.org/), with the addition of allowing a "v" at the
+      # start of a tag name.
+      #
+      # We default to a strict regex as we simply don't know what kind of data
+      # users put in their tags. As such, using simpler patterns (e.g. just
+      # `\d+` for the major version) could lead to unexpected results.
+      #
+      # We use a String here as `Gitlab::UntrustedRegexp` is a mutable object.
+      DEFAULT_TAG_REGEX = '^v?(?P<major>0|[1-9]\d*)' \
+        '\.(?P<minor>0|[1-9]\d*)' \
+        '\.(?P<patch>0|[1-9]\d*)' \
+        '(?:-(?P<pre>(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))' \
+        '?(?:\+(?P<meta>[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
+
+      attr_accessor :date_format, :categories, :template, :tag_regex
 
       def self.from_git(project)
         if (yaml = project.repository.changelog_config)
@@ -46,6 +63,10 @@ module Gitlab
           end
         end
 
+        if (regex = hash['tag_regex'])
+          config.tag_regex = regex
+        end
+
         config
       end
 
@@ -54,6 +75,7 @@ module Gitlab
         @date_format = DEFAULT_DATE_FORMAT
         @template = Parser.new.parse_and_transform(DEFAULT_TEMPLATE)
         @categories = {}
+        @tag_regex = DEFAULT_TAG_REGEX
       end
 
       def contributor?(user)