Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Boxiang Sun
gitlab-ce
Commits
4ef1447c
Commit
4ef1447c
authored
Aug 11, 2018
by
Stan Hu
Committed by
Jose Vargas
Aug 28, 2018
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Block link-local addresses in URLBlocker
Closes
https://gitlab.com/gitlab-com/migration/issues/766
parent
ec40b369
Changes
3
Show whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
37 additions
and
1 deletion
+37
-1
changelogs/unreleased/sh-block-link-local-master.yml
changelogs/unreleased/sh-block-link-local-master.yml
+5
-0
lib/gitlab/url_blocker.rb
lib/gitlab/url_blocker.rb
+8
-0
spec/lib/gitlab/url_blocker_spec.rb
spec/lib/gitlab/url_blocker_spec.rb
+24
-1
No files found.
changelogs/unreleased/sh-block-link-local-master.yml
0 → 100644
View file @
4ef1447c
---
title
:
Block link-local addresses in URLBlocker
merge_request
:
author
:
type
:
security
lib/gitlab/url_blocker.rb
View file @
4ef1447c
...
@@ -31,6 +31,7 @@ module Gitlab
...
@@ -31,6 +31,7 @@ module Gitlab
validate_localhost!
(
addrs_info
)
unless
allow_localhost
validate_localhost!
(
addrs_info
)
unless
allow_localhost
validate_local_network!
(
addrs_info
)
unless
allow_local_network
validate_local_network!
(
addrs_info
)
unless
allow_local_network
validate_link_local!
(
addrs_info
)
unless
allow_local_network
true
true
end
end
...
@@ -89,6 +90,13 @@ module Gitlab
...
@@ -89,6 +90,13 @@ module Gitlab
raise
BlockedUrlError
,
"Requests to the local network are not allowed"
raise
BlockedUrlError
,
"Requests to the local network are not allowed"
end
end
def
validate_link_local!
(
addrs_info
)
netmask
=
IPAddr
.
new
(
'169.254.0.0/16'
)
return
unless
addrs_info
.
any?
{
|
addr
|
addr
.
ipv6_linklocal?
||
netmask
.
include?
(
addr
.
ip_address
)
}
raise
BlockedUrlError
,
"Requests to the link local network are not allowed"
end
def
internal?
(
uri
)
def
internal?
(
uri
)
internal_web?
(
uri
)
||
internal_shell?
(
uri
)
internal_web?
(
uri
)
||
internal_shell?
(
uri
)
end
end
...
...
spec/lib/gitlab/url_blocker_spec.rb
View file @
4ef1447c
# coding: utf-8
require
'spec_helper'
require
'spec_helper'
describe
Gitlab
::
UrlBlocker
do
describe
Gitlab
::
UrlBlocker
do
...
@@ -82,6 +83,17 @@ describe Gitlab::UrlBlocker do
...
@@ -82,6 +83,17 @@ describe Gitlab::UrlBlocker do
expect
(
described_class
).
not_to
be_blocked_url
(
"http://
#{
ip
}
"
)
expect
(
described_class
).
not_to
be_blocked_url
(
"http://
#{
ip
}
"
)
end
end
end
end
it
'allows IPv4 link-local endpoints'
do
expect
(
described_class
).
not_to
be_blocked_url
(
'http://169.254.169.254'
)
expect
(
described_class
).
not_to
be_blocked_url
(
'http://169.254.168.100'
)
end
# This is blocked due to the hostname check: https://gitlab.com/gitlab-org/gitlab-ce/issues/50227
it
'blocks IPv6 link-local endpoints'
do
expect
(
described_class
).
to
be_blocked_url
(
'http://[::ffff:169.254.169.254]'
)
expect
(
described_class
).
to
be_blocked_url
(
'http://[::ffff:169.254.168.100]'
)
end
end
end
context
'false'
do
context
'false'
do
...
@@ -96,10 +108,21 @@ describe Gitlab::UrlBlocker do
...
@@ -96,10 +108,21 @@ describe Gitlab::UrlBlocker do
expect
(
described_class
).
to
be_blocked_url
(
"http://
#{
ip
}
"
,
allow_local_network:
false
)
expect
(
described_class
).
to
be_blocked_url
(
"http://
#{
ip
}
"
,
allow_local_network:
false
)
end
end
end
end
it
'blocks IPv4 link-local endpoints'
do
expect
(
described_class
).
to
be_blocked_url
(
'http://169.254.169.254'
,
allow_local_network:
false
)
expect
(
described_class
).
to
be_blocked_url
(
'http://169.254.168.100'
,
allow_local_network:
false
)
end
it
'blocks IPv6 link-local endpoints'
do
expect
(
described_class
).
to
be_blocked_url
(
'http://[::ffff:169.254.169.254]'
,
allow_local_network:
false
)
expect
(
described_class
).
to
be_blocked_url
(
'http://[::ffff:169.254.168.100]'
,
allow_local_network:
false
)
expect
(
described_class
).
to
be_blocked_url
(
'http://[FE80::C800:EFF:FE74:8]'
,
allow_local_network:
false
)
end
end
end
def
stub_domain_resolv
(
domain
,
ip
)
def
stub_domain_resolv
(
domain
,
ip
)
allow
(
Addrinfo
).
to
receive
(
:getaddrinfo
).
with
(
domain
,
any_args
).
and_return
([
double
(
ip_address:
ip
,
ipv4_private?:
true
)])
allow
(
Addrinfo
).
to
receive
(
:getaddrinfo
).
with
(
domain
,
any_args
).
and_return
([
double
(
ip_address:
ip
,
ipv4_private?:
true
,
ipv6_link_local?:
false
)])
end
end
def
unstub_domain_resolv
def
unstub_domain_resolv
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment