Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
heptapod
heptapod
Commits
d2a653bc48c7
Unverified
Commit
e6cc7a0a
authored
Mar 06, 2017
by
Dmitriy Zaporozhets
Browse files
Restrict nested group names to prevent ambiguous routes
Signed-off-by:
Dmitriy Zaporozhets
<
dmitriy.zaporozhets@gmail.com
>
parent
d7d987c3bad6
Changes
4
Hide whitespace changes
Inline
Side-by-side
app/validators/namespace_validator.rb
View file @
d2a653bc
...
...
@@ -35,12 +35,21 @@ class NamespaceValidator < ActiveModel::EachValidator
users
]
.
freeze
WILDCARD_ROUTES
=
%w[tree commits wikis new edit create update logs_tree
preview blob blame raw files create_dir find_file]
.
freeze
STRICT_RESERVED
=
(
RESERVED
+
WILDCARD_ROUTES
).
freeze
def
self
.
valid?
(
value
)
!
reserved?
(
value
)
&&
follow_format?
(
value
)
end
def
self
.
reserved?
(
value
)
RESERVED
.
include?
(
value
)
def
self
.
reserved?
(
value
,
strict:
false
)
if
strict
STRICT_RESERVED
.
include?
(
value
)
else
RESERVED
.
include?
(
value
)
end
end
def
self
.
follow_format?
(
value
)
...
...
@@ -54,7 +63,9 @@ def validate_each(record, attribute, value)
record
.
errors
.
add
(
attribute
,
Gitlab
::
Regex
.
namespace_regex_message
)
end
if
reserved?
(
value
)
strict
=
record
.
is_a?
(
Group
)
&&
record
.
parent_id
if
reserved?
(
value
,
strict:
strict
)
record
.
errors
.
add
(
attribute
,
"
#{
value
}
is a reserved name"
)
end
end
...
...
app/validators/project_path_validator.rb
View file @
d2a653bc
...
...
@@ -14,10 +14,8 @@ class ProjectPathValidator < ActiveModel::EachValidator
# without tree as reserved name routing can match 'group/project' as group name,
# 'tree' as project name and 'deploy_keys' as route.
#
RESERVED
=
(
NamespaceValidator
::
RESERVED
-
%w[dashboard help ci admin search notes services assets profile public]
+
%w[tree commits wikis new edit create update logs_tree
preview blob blame raw files create_dir find_file]
).
freeze
RESERVED
=
(
NamespaceValidator
::
STRICT_RESERVED
-
%w[dashboard help ci admin search notes services assets profile public]
).
freeze
def
self
.
valid?
(
value
)
!
reserved?
(
value
)
...
...
changelogs/unreleased/dz-nested-groups-restrictions.yml
0 → 100644
View file @
d2a653bc
---
title
:
Restrict nested group names to prevent ambiguous routes
merge_request
:
9738
author
:
spec/models/namespace_spec.rb
View file @
d2a653bc
...
...
@@ -28,6 +28,20 @@
expect
(
nested
).
not_to
be_valid
expect
(
nested
.
errors
[
:parent_id
].
first
).
to
eq
(
'has too deep level of nesting'
)
end
describe
'reserved path validation'
do
context
'nested group'
do
let
(
:group
)
{
build
(
:group
,
:nested
,
path:
'tree'
)
}
it
{
expect
(
group
).
not_to
be_valid
}
end
context
'top-level group'
do
let
(
:group
)
{
build
(
:group
,
path:
'tree'
)
}
it
{
expect
(
group
).
to
be_valid
}
end
end
end
describe
"Respond to"
do
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment