From c5a9d73ad8a141166d871e551027208014a281c0 Mon Sep 17 00:00:00 2001 From: Jacob Schatz Date: Wed, 15 Mar 2017 21:21:48 +0000 Subject: Merge branch 'fix-links-target-blank' into 'security' Adds rel="noopener noreferrer" to all links with target="_blank" See merge request !2071 --- lib/banzai/filter/image_link_filter.rb | 4 ++-- lib/banzai/filter/video_link_filter.rb | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/banzai/filter/image_link_filter.rb b/lib/banzai/filter/image_link_filter.rb index 651b55523c0..123c92fd250 100644 --- a/lib/banzai/filter/image_link_filter.rb +++ b/lib/banzai/filter/image_link_filter.rb @@ -2,7 +2,6 @@ module Banzai module Filter # HTML filter that wraps links around inline images. class ImageLinkFilter < HTML::Pipeline::Filter - # Find every image that isn't already wrapped in an `a` tag, create # a new node (a link to the image source), copy the image as a child # of the anchor, and then replace the img with the link-wrapped version. @@ -12,7 +11,8 @@ module Banzai 'a', class: 'no-attachment-icon', href: img['src'], - target: '_blank' + target: '_blank', + rel: 'noopener noreferrer' ) link.children = img.clone diff --git a/lib/banzai/filter/video_link_filter.rb b/lib/banzai/filter/video_link_filter.rb index b64a1287d4d..35cb10eae5d 100644 --- a/lib/banzai/filter/video_link_filter.rb +++ b/lib/banzai/filter/video_link_filter.rb @@ -43,6 +43,7 @@ module Banzai element['title'] || element['alt'], href: element['src'], target: '_blank', + rel: 'noopener noreferrer', title: "Download '#{element['title'] || element['alt']}'") download_paragraph = doc.document.create_element('p') download_paragraph.children = link -- cgit v1.2.1 From 65aafb9917fb8fd4d26ca096681ca29a9a6ddda2 Mon Sep 17 00:00:00 2001 From: Douwe Maan Date: Wed, 15 Mar 2017 20:09:08 +0000 Subject: Merge branch 'ssrf' into 'security' Protect server against SSRF in project import URLs See merge request !2068 --- lib/gitlab/url_blocker.rb | 57 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 lib/gitlab/url_blocker.rb (limited to 'lib') diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb new file mode 100644 index 00000000000..bb2f4edc1a0 --- /dev/null +++ b/lib/gitlab/url_blocker.rb @@ -0,0 +1,57 @@ +require 'resolv' + +module Gitlab + class UrlBlocker + class << self + # Used to specify what hosts and port numbers should be prohibited for project + # imports. + VALID_PORTS = [22, 80, 443].freeze + + def blocked_url?(url) + blocked_ips = ["127.0.0.1", "::1", "0.0.0.0"] + blocked_ips.concat(Socket.ip_address_list.map(&:ip_address)) + + begin + uri = Addressable::URI.parse(url) + # Allow imports from the GitLab instance itself but only from the configured ports + return false if internal?(uri) + + return true if blocked_port?(uri.port) + + server_ips = Resolv.getaddresses(uri.hostname) + return true if (blocked_ips & server_ips).any? + rescue Addressable::URI::InvalidURIError + return true + end + + false + end + + private + + def blocked_port?(port) + return false if port.blank? + + port < 1024 && !VALID_PORTS.include?(port) + end + + def internal?(uri) + internal_web?(uri) || internal_shell?(uri) + end + + def internal_web?(uri) + uri.hostname == config.gitlab.host && + (uri.port.blank? || uri.port == config.gitlab.port) + end + + def internal_shell?(uri) + uri.hostname == config.gitlab_shell.ssh_host && + (uri.port.blank? || uri.port == config.gitlab_shell.ssh_port) + end + + def config + Gitlab.config + end + end + end +end -- cgit v1.2.1 From 83a0c39808b132e8759d75cc774e0724f56b17ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= Date: Sat, 18 Mar 2017 17:56:05 +0000 Subject: Merge branch 'ssrf' into 'security' nil check for url_blocker? See merge request !2076 --- lib/gitlab/url_blocker.rb | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lib') diff --git a/lib/gitlab/url_blocker.rb b/lib/gitlab/url_blocker.rb index bb2f4edc1a0..7e14a566696 100644 --- a/lib/gitlab/url_blocker.rb +++ b/lib/gitlab/url_blocker.rb @@ -8,6 +8,8 @@ module Gitlab VALID_PORTS = [22, 80, 443].freeze def blocked_url?(url) + return false if url.nil? + blocked_ips = ["127.0.0.1", "::1", "0.0.0.0"] blocked_ips.concat(Socket.ip_address_list.map(&:ip_address)) -- cgit v1.2.1