Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
heptapod
heptapod
Commits
3e4ab037f2f0
Commit
2fd5cc2b
authored
Nov 02, 2017
by
Brett Walker
Committed by
Nick Thomas
Nov 02, 2017
Browse files
Geo route whitelisting is too optimistic
parent
9eeb9fb96ec4
Changes
3
Hide whitespace changes
Inline
Side-by-side
changelogs/unreleased/3274-geo-route-whitelisting.yml
0 → 100644
View file @
3e4ab037
---
title
:
Tighten up whitelisting of certain Geo routes
merge_request
:
15082
author
:
type
:
fixed
lib/gitlab/middleware/read_only.rb
View file @
3e4ab037
...
...
@@ -12,6 +12,7 @@ def initialize(app)
def
call
(
env
)
@env
=
env
@route_hash
=
nil
if
disallowed_request?
&&
Gitlab
::
Database
.
read_only?
Rails
.
logger
.
debug
(
'GitLab ReadOnly: preventing possible non read-only operation'
)
...
...
@@ -77,11 +78,11 @@ def sidekiq_route
end
def
grack_route
r
equest
.
path
.
end_with?
(
'.git/
git
-
upload
-
pack'
)
r
oute_hash
[
:controller
]
==
'projects/git_http'
&&
route_hash
[
:action
]
==
'
git
_
upload
_
pack'
end
def
lfs_route
r
equest
.
path
.
end_with?
(
'/info/lfs/objects/
batch'
)
r
oute_hash
[
:controller
]
==
'projects/lfs_api'
&&
route_hash
[
:action
]
==
'
batch'
end
end
end
...
...
spec/lib/gitlab/middleware/read_only_spec.rb
View file @
3e4ab037
...
...
@@ -83,6 +83,13 @@
expect
(
subject
).
to
disallow_request
end
it
'expects POST of new file that looks like an LFS batch url to be disallowed'
do
response
=
request
.
post
(
'/root/gitlab-ce/new/master/app/info/lfs/objects/batch'
)
expect
(
response
).
to
be_a_redirect
expect
(
subject
).
to
disallow_request
end
context
'whitelisted requests'
do
it
'expects DELETE request to logout to be allowed'
do
response
=
request
.
delete
(
'/users/sign_out'
)
...
...
@@ -104,6 +111,25 @@
expect
(
response
).
not_to
be_a_redirect
expect
(
subject
).
not_to
disallow_request
end
it
'expects a POST request to git-upload-pack URL to be allowed'
do
response
=
request
.
post
(
'/root/rouge.git/git-upload-pack'
)
expect
(
response
).
not_to
be_a_redirect
expect
(
subject
).
not_to
disallow_request
end
it
'expects requests to sidekiq admin to be allowed'
do
response
=
request
.
post
(
'/admin/sidekiq'
)
expect
(
response
).
not_to
be_a_redirect
expect
(
subject
).
not_to
disallow_request
response
=
request
.
get
(
'/admin/sidekiq'
)
expect
(
response
).
not_to
be_a_redirect
expect
(
subject
).
not_to
disallow_request
end
end
end
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment