Commit b44fdca0 authored by Mayra Cabrera's avatar Mayra Cabrera

Ensures SSRF requests are not allowed by include directive

'allow_local_requests' argument was removed from File::Remote in the external module.

Related to https://gitlab.com/gitlab-org/gitlab-ee/issues/6002
parent d7f95be9
---
title: Fixes include directive to not allow SSRF requests
merge_request:
author:
type: security
......@@ -11,7 +11,7 @@ module Gitlab
@content = strong_memoize(:content) do
begin
Gitlab::HTTP.get(location, allow_local_requests: true)
Gitlab::HTTP.get(location)
rescue Gitlab::HTTP::Error, Timeout::Error, SocketError
nil
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment