Commit ff65e556 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Merge branch 'sanitize-snippet-file-name' into 'master'

Validate and sanitize snippet file name

Fixes #1816

See merge request !1322
parents b205db63 bfebab1c
No related merge requests found
......@@ -68,7 +68,7 @@ class Projects::SnippetsController < Projects::ApplicationController
@snippet.content,
type: 'text/plain; charset=utf-8',
disposition: 'inline',
filename: @snippet.file_name
filename: @snippet.sanitized_file_name
)
end
......
......@@ -79,7 +79,7 @@ class SnippetsController < ApplicationController
@snippet.content,
type: 'text/plain; charset=utf-8',
disposition: 'inline',
filename: @snippet.file_name
filename: @snippet.sanitized_file_name
)
end
......
......@@ -29,7 +29,9 @@ class Snippet < ActiveRecord::Base
validates :author, presence: true
validates :title, presence: true, length: { within: 0..255 }
validates :file_name, presence: true, length: { within: 0..255 }
validates :file_name, presence: true, length: { within: 0..255 },
format: { with: Gitlab::Regex.path_regex,
message: Gitlab::Regex.path_regex_message }
validates :content, presence: true
validates :visibility_level, inclusion: { in: Gitlab::VisibilityLevel.values }
......@@ -62,6 +64,10 @@ class Snippet < ActiveRecord::Base
file_name
end
def sanitized_file_name
file_name.gsub(/[^a-zA-Z0-9_\-\.]+/, '')
end
def mode
nil
end
......
......@@ -5,10 +5,14 @@ FactoryGirl.define do
Faker::Lorem.sentence
end
sequence :name, aliases: [:file_name] do
sequence :name do
Faker::Name.name
end
sequence :file_name do
Faker::Internet.user_name
end
sequence(:url) { Faker::Internet.uri('http') }
factory :user, aliases: [:author, :assignee, :owner, :creator] do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment