From 9fee2c5a068e9439136ff362b89d25640c9e44a7 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Thu, 30 Mar 2023 11:21:44 +0000 Subject: Add latest changes from gitlab-org/security/gitlab@15-8-stable-ee --- lib/gitlab/url_sanitizer.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/gitlab/url_sanitizer.rb b/lib/gitlab/url_sanitizer.rb index 79e124a58f5..da078cc7b92 100644 --- a/lib/gitlab/url_sanitizer.rb +++ b/lib/gitlab/url_sanitizer.rb @@ -7,7 +7,7 @@ module Gitlab ALLOWED_SCHEMES = %w[http https ssh git].freeze ALLOWED_WEB_SCHEMES = %w[http https].freeze SCHEMIFIED_SCHEME = 'glschemelessuri' - SCHEMIFY_PLACEHOLDER = "#{SCHEMIFIED_SCHEME}://".freeze + SCHEMIFY_PLACEHOLDER = "#{SCHEMIFIED_SCHEME}://" # URI::DEFAULT_PARSER.make_regexp will only match URLs with schemes or # relative URLs. This section will match schemeless URIs with userinfo # e.g. user:pass@gitlab.com but will not match scp-style URIs e.g. @@ -25,7 +25,7 @@ module Gitlab (?!#{URI::REGEXP::PATTERN::HOST}:(?:#{URI::REGEXP::PATTERN::REL_PATH}|#{URI::REGEXP::PATTERN::ABS_PATH})) #{URI::REGEXP::PATTERN::HOSTPORT} ) - }x + }x.freeze def self.sanitize(content) content.gsub(URI_REGEXP) do |url| -- cgit v1.2.1