lib/api/validations/validators/file_path.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

# frozen_string_literal: true

module API
  module Validations
    module Validators
      class FilePath < Grape::Validations::Base
        def validate_param!(attr_name, params)
          options = @option.is_a?(Hash) ? @option : {}
          path_allowlist = options.fetch(:allowlist, [])
          path = params[attr_name]
          path = Gitlab::Utils.check_path_traversal!(path)
          Gitlab::Utils.check_allowed_absolute_path!(path, path_allowlist)
        rescue
          raise Grape::Exceptions::Validation.new(
            params: [@scope.full_name(attr_name)],
            message: "should be a valid file path"
          )
        end
      end
    end
  end
end