Skip to content
GitLab
Menu
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
heptapod
heptapod
Commits
ca17fd8ec552
Commit
ca17fd8e
authored
Dec 01, 2017
by
Christiaan Van den Poel
Browse files
Adds validation for Project#ci_config_path not to contain leading slash
parent
f2e86e9964ee
Changes
3
Hide whitespace changes
Inline
Side-by-side
app/models/project.rb
View file @
ca17fd8e
...
...
@@ -234,8 +234,8 @@
validates
:creator
,
presence:
true
,
on: :create
validates
:description
,
length:
{
maximum:
2000
},
allow_blank:
true
validates
:ci_config_path
,
format:
{
without:
/\.{2}/
,
message:
'cannot include directory traversal.'
},
format:
{
without:
/
(
\.{2}
|\A\/)
/
,
message:
'cannot include
leading slash or
directory traversal.'
},
length:
{
maximum:
255
},
allow_blank:
true
validates
:name
,
...
...
@@ -599,7 +599,7 @@
def
ci_config_path
=
(
value
)
# Strip all leading slashes so that //foo -> foo
super
(
value
&
.
sub
(
%r{
\A
/+}
,
''
)
&
.
delete
(
"
\0
"
))
super
(
value
&
.
delete
(
"
\0
"
))
end
def
import_url
=
(
value
)
...
...
changelogs/unreleased/add_project_ci_config_path_leading_slash_validation.yml
0 → 100644
View file @
ca17fd8e
---
title
:
Prefer ci_config_path validation for leading slashes instead of sanitizing
the input
merge_request
:
15672
author
:
Christiaan Van den Poel
type
:
other
spec/models/project_spec.rb
View file @
ca17fd8e
...
...
@@ -138,6 +138,7 @@
it
{
is_expected
.
to
validate_length_of
(
:ci_config_path
).
is_at_most
(
255
)
}
it
{
is_expected
.
to
allow_value
(
''
).
for
(
:ci_config_path
)
}
it
{
is_expected
.
not_to
allow_value
(
'test/../foo'
).
for
(
:ci_config_path
)
}
it
{
is_expected
.
not_to
allow_value
(
'/test/foo'
).
for
(
:ci_config_path
)
}
it
{
is_expected
.
to
validate_presence_of
(
:creator
)
}
...
...
@@ -1548,8 +1549,8 @@
expect
(
project
.
ci_config_path
).
to
eq
(
'foo/.gitlab_ci.yml'
)
end
it
'sets a string but removes all
leading slashes and
null characters'
do
project
.
update!
(
ci_config_path:
"
///
f
\0
oo/
\0
/.gitlab_ci.yml"
)
it
'sets a string but removes all null characters'
do
project
.
update!
(
ci_config_path:
"f
\0
oo/
\0
/.gitlab_ci.yml"
)
expect
(
project
.
ci_config_path
).
to
eq
(
'foo//.gitlab_ci.yml'
)
end
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment