Commit 34da204e authored by Christiaan Van den Poel's avatar Christiaan Van den Poel Committed by Grzegorz Bizon
Browse files

Adds validation for Project#ci_config_path not to contain leading slash

parent f2e86e9964ee
......@@ -234,8 +234,8 @@ class Project < ActiveRecord::Base
validates :creator, presence: true, on: :create
validates :description, length: { maximum: 2000 }, allow_blank: true
validates :ci_config_path,
format: { without: /\.{2}/,
message: 'cannot include directory traversal.' },
format: { without: /(\.{2}|\A\/)/,
message: 'cannot include leading slash or directory traversal.' },
length: { maximum: 255 },
allow_blank: true
validates :name,
......@@ -599,7 +599,7 @@ def remove_import_data
def ci_config_path=(value)
# Strip all leading slashes so that //foo -> foo
super(value&.sub(%r{\A/+}, '')&.delete("\0"))
super(value&.delete("\0"))
end
def import_url=(value)
......
---
title: Prefer ci_config_path validation for leading slashes instead of sanitizing
the input
merge_request: 15672
author: Christiaan Van den Poel
type: other
......@@ -138,6 +138,7 @@
it { is_expected.to validate_length_of(:ci_config_path).is_at_most(255) }
it { is_expected.to allow_value('').for(:ci_config_path) }
it { is_expected.not_to allow_value('test/../foo').for(:ci_config_path) }
it { is_expected.not_to allow_value('/test/foo').for(:ci_config_path) }
it { is_expected.to validate_presence_of(:creator) }
......@@ -1548,8 +1549,8 @@ def create_pipeline
expect(project.ci_config_path).to eq('foo/.gitlab_ci.yml')
end
it 'sets a string but removes all leading slashes and null characters' do
project.update!(ci_config_path: "///f\0oo/\0/.gitlab_ci.yml")
it 'sets a string but removes all null characters' do
project.update!(ci_config_path: "f\0oo/\0/.gitlab_ci.yml")
expect(project.ci_config_path).to eq('foo//.gitlab_ci.yml')
end
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment