| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Add latest changes from gitlab-org/gitlab@master | GitLab Bot | 2020-03-31 | 1 | -2/+2 |
| | | |||||
| * | Add latest changes from gitlab-org/gitlab@master | GitLab Bot | 2020-03-16 | 1 | -4/+4 |
| | | |||||
| * | Add latest changes from gitlab-org/gitlab@master | GitLab Bot | 2019-10-03 | 1 | -0/+5 |
| | | |||||
| * | Add latest changes from gitlab-org/gitlab@master | GitLab Bot | 2019-09-13 | 1 | -30/+18 |
| | | |||||
| * | Allow not resolvable urls when rebinding setting is disabled | Francisco Javier López | 2019-09-05 | 1 | -2/+6 |
| | | | | | | Now, when the dns rebinging setting is disabled, we will allow urls that are not resolvable. | ||||
| * | Fix broken master because of security merge | Francisco Javier López | 2019-07-29 | 1 | -5/+2 |
| | | |||||
| * | Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhq | Robert Speicher | 2019-07-29 | 1 | -2/+14 |
| |\ | |||||
| | * | Fix Server Side Request Forgery mitigation bypass | Francisco Javier López | 2019-07-15 | 1 | -2/+11 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When we can't resolve the hostname or it is invalid, we shouldn't even perform the request. This fix also fixes the problem the SSRF rebinding attack. We can't stub feature flags outside example blocks. Nevertheless, there are some actions that calls the UrlBlocker, that are performed outside example blocks, ie: `set` instruction. That's why we have to use some signalign mechanism outside the scope of the specs. | ||||
| * | | [ADD] outbound requests whitelist | Reuben Pereira | 2019-07-24 | 1 | -6/+30 |
| |/ | | | | Signed-off-by: Istvan szalai <istvan.szalai@savoirfairelinux.com> | ||||
| * | Don't use bang method when there is no safe method | Reuben Pereira | 2019-07-12 | 1 | -33/+59 |
| | | | | | https://github.com/rubocop-hq/ruby-style-guide#dangerous-method-bang | ||||
| * | Add DNS rebinding protection settings | Oswaldo Ferreira | 2019-05-30 | 1 | -10/+24 |
| | | |||||
| * | Protect Gitlab::HTTP against DNS rebinding attack | Douwe Maan | 2019-05-30 | 1 | -13/+48 |
| | | | | | | | Gitlab::HTTP now resolves the hostname only once, verifies the IP is not blocked, and then uses the same IP to perform the actual request, while passing the original hostname in the `Host` header and SSL SNI field. | ||||
| * | Align UrlValidator to validate_url gem implementation. | Thong Kuah | 2019-04-11 | 1 | -5/+5 |
| | | | | | | | | Renamed UrlValidator to AddressableUrlValidator to avoid 'url:' naming collision with ActiveModel::Validations::UrlValidator in 'validates' statement. Make use of the options attribute of the parent class ActiveModel::EachValidator. Add more options: allow_nil, allow_blank, message. Renamed 'protocols' option to 'schemes' to match the option naming from UrlValidator. | ||||
| * | Add table and model for error tracking settings | Reuben Pereira | 2019-01-07 | 1 | -2/+16 |
| | | |||||
| * | Allow URLs to be validated as ascii_only | James Edwards-Jones | 2018-12-06 | 1 | -1/+8 |
| | | | | | | Restricts unicode characters and IDNA deviations which could be used in a phishing attack | ||||
| * | Merge branch 'security-11-5-fix-webhook-ssrf-ipv6' into 'security-11-5' | Steve Azzopardi | 2018-11-28 | 1 | -4/+8 |
| | | | | | | [11.5] Fix SSRF in project integrations See merge request gitlab/gitlabhq!2611 | ||||
| * | Merge branch 'security-fj-crlf-injection' into 'master' | Cindy Pallares | 2018-11-28 | 1 | -5/+14 |
| | | | | | | [master] Fix CRLF issue in UrlValidator See merge request gitlab/gitlabhq!2627 | ||||
| * | Merge branch 'security-stored-xss-for-environments' into 'master' | Cindy Pallares | 2018-11-28 | 1 | -2/+4 |
| | | | | | | | | [master] Stored XSS for Environments Closes #2727 See merge request gitlab/gitlabhq!2594 | ||||
| * | Merge branch 'sh-block-other-localhost' into 'master' | Thiago Presa | 2018-10-25 | 1 | -0/+7 |
| |\ | | | | | | | | | Block additional localhost addresses in UrlBlocker See merge request gitlab/gitlabhq!2487 | ||||
| | * | Block loopback addresses in UrlBlocker | Stan Hu | 2018-09-05 | 1 | -0/+7 |
| | | | | | | | | | Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/51128 | ||||
| * | | Enable frozen string for lib/gitlab/*.rb | gfyoung | 2018-10-22 | 1 | -0/+2 |
| |/ | |||||
| * | Block link-local addresses in URLBlocker | Stan Hu | 2018-08-12 | 1 | -0/+8 |
| | | | | | Closes https://gitlab.com/gitlab-com/migration/issues/766 | ||||
| * | Avoid checking the user format in every url validation | Francisco Javier López | 2018-06-11 | 1 | -2/+2 |
| | | |||||
| * | Add validation to webhook and service URLs to ensure they are not blocked ↵ | Francisco Javier López | 2018-06-01 | 1 | -5/+12 |
| | | | | | because of SSRF | ||||
| * | Rename allow_private_networks to allow_local_network | Douwe Maan | 2018-04-02 | 1 | -2/+2 |
| | | |||||
| * | Make error messages even more descriptive | Douwe Maan | 2018-04-02 | 1 | -33/+47 |
| | | |||||
| * | Raise more descriptive errors when URLs are blocked | Douwe Maan | 2018-04-02 | 1 | -14/+32 |
| | | |||||
| * | Merge branch 'fj-15329-services-callbacks-ssrf' into 'security-10-6' | Douwe Maan | 2018-03-21 | 1 | -10/+13 |
| | | | | | | Server Side Request Forgery in Services and Web Hooks See merge request gitlab/gitlabhq!2337 | ||||
| * | Merge branch 'ssrf-protections-round-2' into 'security-10-1' | Douwe Maan | 2017-11-08 | 1 | -1/+3 |
| | | | | | | | | | | Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions See merge request gitlab/gitlabhq!2219 (cherry picked from commit 4a1e73783d5480aa514db7b53e10c075f95580b5) 1bffa0c3 Replace SSRF resolver with Addrinfo.getaddrinfo to include alternative localhost versions | ||||
| * | Merge branch 'rs-alphanumeric-ssh-params' into 'security-9-4'jej/security-release-2017-08-10 | James Edwards-Jones | 2017-08-10 | 1 | -0/+8 |
| | | | | | | Ensure user and hostnames begin with an alnum character in UrlBlocker See merge request !2138 | ||||
| * | Merge branch 'ssrf' into 'security' | Rubén Dávila | 2017-03-20 | 1 | -0/+2 |
| | | | | | | nil check for url_blocker? See merge request !2076 | ||||
| * | Merge branch 'ssrf' into 'security' | Douwe Maan | 2017-03-20 | 1 | -0/+57 |
| Protect server against SSRF in project import URLs See merge request !2068 | |||||
 |
index : delta/gitlab/gitlab-ce.git | |
| gitlab.com: gitlab-org/gitlab-ce.git |
| summaryrefslogtreecommitdiff |