1. 24 Jul, 2019 10 commits
  2. 17 Jul, 2019 1 commit
    • Bob Van Landuyt's avatar
      Filter params in MR build service · 8af7f42c
      Bob Van Landuyt authored
      Reusing the existing `IssuableBaseService#filter_params` which uses
      the policies to determine what params a user can set, and which values
      it can be set to.
      
      This also removed the need for the seperate call to
      `IssuableBaseService#ensure_milestone_available`.
      
      The `Issues::BuildService` does not suffer from this because it limits
      the params that are assignable to the `title`, `description` and
      `milestone_id`.
      8af7f42c
  3. 16 Jul, 2019 1 commit
  4. 15 Jul, 2019 1 commit
  5. 12 Jul, 2019 1 commit
  6. 10 Jul, 2019 1 commit
  7. 09 Jul, 2019 1 commit
  8. 08 Jul, 2019 1 commit
    • Kerri Miller's avatar
      Extract SanitizeNodeLink and apply to WikiLinkFilter · 727f0ede
      Kerri Miller authored
      The SanitizationFilter was running before the WikiFilter. Since
      WikiFilter can modify links, we could see links that _should_ be stopped
      by SanatizationFilter being rendered on the page. I (kerrizor) had
      previously addressed the bug in: https://gitlab.com/gitlab-org/gitlab-ee/commit/7bc971915bbeadb950bb0e1f13510bf3038229a4
      However, an additional exploit was discovered after that was merged.
      Working through the issue, we couldn't simply shuffle the order of
      filters, due to some implicit assumptions about the order of filters, so
      instead we've extracted the logic that sanitizes a Nokogiri-generated
      Node object, and applied it to the WikiLinkFilter as well.
      
      On moving filters around:
      Once we start moving around filters, we get cascading failures; fix one,
      another one crops up. Many of the existing filters in the WikiPipeline
      chain seem to assume that other filters have already done their work,
      and thus operate on a "transform anything that's left" basis;
      WikiFilter, for instance, assumes any link it finds in the markdown
      should be prepended with the wiki_base_path.. but if it does that, it
      also turns `href="@user"` into `href="/path/to/wiki/@user"`, which the
      UserReferenceFilter doesn't see as a user reference it needs to
      transform into a user profile link. This is true for all the reference
      filters in the WikiPipeline.
      727f0ede
  9. 05 Jul, 2019 1 commit
  10. 04 Jul, 2019 1 commit
    • Francisco Javier López's avatar
      Fix Server Side Request Forgery mitigation bypass · de9b7a69
      Francisco Javier López authored
      When we can't resolve the hostname or it is invalid, we shouldn't
      even perform the request. This fix also fixes the problem the
      SSRF rebinding attack.
      
      We can't stub feature flags outside example blocks. Nevertheless,
      there are some actions that calls the UrlBlocker, that are performed
      outside example blocks, ie: `set` instruction.
      
      That's why we have to use some signalign mechanism outside the scope
      of the specs.
      de9b7a69
  11. 01 Jul, 2019 2 commits
  12. 30 Jun, 2019 1 commit
  13. 27 Jun, 2019 3 commits
  14. 26 Jun, 2019 15 commits