Commit ff65e556 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets
Browse files

Merge branch 'sanitize-snippet-file-name' into 'master'

Validate and sanitize snippet file name

Fixes #1816

See merge request !1322
......@@ -68,7 +68,7 @@ def raw
@snippet.content,
type: 'text/plain; charset=utf-8',
disposition: 'inline',
filename: @snippet.file_name
filename: @snippet.sanitized_file_name
)
end
......
......@@ -79,7 +79,7 @@ def raw
@snippet.content,
type: 'text/plain; charset=utf-8',
disposition: 'inline',
filename: @snippet.file_name
filename: @snippet.sanitized_file_name
)
end
......
......@@ -29,7 +29,9 @@ class Snippet < ActiveRecord::Base
validates :author, presence: true
validates :title, presence: true, length: { within: 0..255 }
validates :file_name, presence: true, length: { within: 0..255 }
validates :file_name, presence: true, length: { within: 0..255 },
format: { with: Gitlab::Regex.path_regex,
message: Gitlab::Regex.path_regex_message }
validates :content, presence: true
validates :visibility_level, inclusion: { in: Gitlab::VisibilityLevel.values }
......@@ -62,6 +64,10 @@ def name
file_name
end
def sanitized_file_name
file_name.gsub(/[^a-zA-Z0-9_\-\.]+/, '')
end
def mode
nil
end
......@@ -72,7 +78,7 @@ def expired?
def visibility_level_field
visibility_level
end
end
class << self
def search(query)
......
......@@ -5,10 +5,14 @@
Faker::Lorem.sentence
end
sequence :name, aliases: [:file_name] do
sequence :name do
Faker::Name.name
end
sequence :file_name do
Faker::Internet.user_name
end
sequence(:url) { Faker::Internet.uri('http') }
factory :user, aliases: [:author, :assignee, :owner, :creator] do
......@@ -18,7 +22,7 @@
password "12345678"
password_confirmation { password }
confirmed_at { Time.now }
confirmation_token { nil }
confirmation_token { nil }
trait :admin do
admin true
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment