Commit b44fdca0 authored by Mayra Cabrera's avatar Mayra Cabrera

Ensures SSRF requests are not allowed by include directive

'allow_local_requests' argument was removed from File::Remote in the external module.

Related to https://gitlab.com/gitlab-org/gitlab-ee/issues/6002
parent d7f95be9
---
title: Fixes include directive to not allow SSRF requests
merge_request:
author:
type: security
...@@ -11,7 +11,7 @@ module Gitlab ...@@ -11,7 +11,7 @@ module Gitlab
@content = strong_memoize(:content) do @content = strong_memoize(:content) do
begin begin
Gitlab::HTTP.get(location, allow_local_requests: true) Gitlab::HTTP.get(location)
rescue Gitlab::HTTP::Error, Timeout::Error, SocketError rescue Gitlab::HTTP::Error, Timeout::Error, SocketError
nil nil
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment