From e92925533667e147ff34cf1e9b8af21680c8c7d4 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Mon, 30 Jan 2023 09:13:00 +0000 Subject: Add latest changes from gitlab-org/security/gitlab@15-8-stable-ee --- app/models/concerns/sanitizable.rb | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'app/models/concerns/sanitizable.rb') diff --git a/app/models/concerns/sanitizable.rb b/app/models/concerns/sanitizable.rb index 05756beb404..653d7a4875d 100644 --- a/app/models/concerns/sanitizable.rb +++ b/app/models/concerns/sanitizable.rb @@ -45,6 +45,15 @@ module Sanitizable unless input.to_s == CGI.unescapeHTML(input.to_s) record.errors.add(attr, 'cannot contain escaped HTML entities') end + + # This method raises an exception on failure so perform this + # last if multiple errors should be returned. + Gitlab::Utils.check_path_traversal!(input.to_s) + + rescue Gitlab::Utils::DoubleEncodingError + record.errors.add(attr, 'cannot contain escaped components') + rescue Gitlab::Utils::PathTraversalAttackError + record.errors.add(attr, "cannot contain a path traversal component") end end end -- cgit v1.2.1