This instance will be upgraded to Heptapod 0.26.0rc1 on 2021-10-26 at 14:30 UTC+2 (a few minutes of down time)

Commit 79674230 authored by Heinrich Lee Yu's avatar Heinrich Lee Yu Committed by Yorick Peterse
Browse files

Fix slow project reference pattern regex

parent a1e28b5881c3
......@@ -530,6 +530,7 @@ def sort_by_attribute(method)
def reference_pattern
%r{
(?<!#{Gitlab::PathRegex::PATH_START_CHAR})
((?<namespace>#{Gitlab::PathRegex::FULL_NAMESPACE_FORMAT_REGEX})\/)?
(?<project>#{Gitlab::PathRegex::PROJECT_PATH_FORMAT_REGEX})
}x
......
---
title: Fix slow regex in project reference pattern
merge_request:
author:
type: security
......@@ -125,7 +125,8 @@ module PathRegex
# allow non-regex validations, etc), `NAMESPACE_FORMAT_REGEX_JS` serves as a Javascript-compatible version of
# `NAMESPACE_FORMAT_REGEX`, with the negative lookbehind assertion removed. This means that the client-side validation
# will pass for usernames ending in `.atom` and `.git`, but will be caught by the server-side validation.
PATH_REGEX_STR = '[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*'.freeze
PATH_START_CHAR = '[a-zA-Z0-9_\.]'.freeze
PATH_REGEX_STR = PATH_START_CHAR + '[a-zA-Z0-9_\-\.]*'.freeze
NAMESPACE_FORMAT_REGEX_JS = PATH_REGEX_STR + '[a-zA-Z0-9_\-]|[a-zA-Z0-9_]'.freeze
NO_SUFFIX_REGEX = /(?<!\.git|\.atom)/.freeze
......
......@@ -26,6 +26,12 @@ def get_reference(project)
expect(reference_filter(act).to_html).to eq(CGI.escapeHTML(exp))
end
it 'fails fast for long invalid string' do
expect do
Timeout.timeout(5.seconds) { reference_filter("A" * 50000).to_html }
end.not_to raise_error
end
it 'allows references with text after the > character' do
doc = reference_filter("Hey #{reference}foo")
expect(doc.css('a').first.attr('href')).to eq urls.project_url(subject)
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment