Commit ff65e556 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Merge branch 'sanitize-snippet-file-name' into 'master'

Validate and sanitize snippet file name

Fixes #1816

See merge request !1322
parents b205db63 bfebab1c
...@@ -68,7 +68,7 @@ class Projects::SnippetsController < Projects::ApplicationController ...@@ -68,7 +68,7 @@ class Projects::SnippetsController < Projects::ApplicationController
@snippet.content, @snippet.content,
type: 'text/plain; charset=utf-8', type: 'text/plain; charset=utf-8',
disposition: 'inline', disposition: 'inline',
filename: @snippet.file_name filename: @snippet.sanitized_file_name
) )
end end
......
...@@ -79,7 +79,7 @@ class SnippetsController < ApplicationController ...@@ -79,7 +79,7 @@ class SnippetsController < ApplicationController
@snippet.content, @snippet.content,
type: 'text/plain; charset=utf-8', type: 'text/plain; charset=utf-8',
disposition: 'inline', disposition: 'inline',
filename: @snippet.file_name filename: @snippet.sanitized_file_name
) )
end end
......
...@@ -29,7 +29,9 @@ class Snippet < ActiveRecord::Base ...@@ -29,7 +29,9 @@ class Snippet < ActiveRecord::Base
validates :author, presence: true validates :author, presence: true
validates :title, presence: true, length: { within: 0..255 } validates :title, presence: true, length: { within: 0..255 }
validates :file_name, presence: true, length: { within: 0..255 } validates :file_name, presence: true, length: { within: 0..255 },
format: { with: Gitlab::Regex.path_regex,
message: Gitlab::Regex.path_regex_message }
validates :content, presence: true validates :content, presence: true
validates :visibility_level, inclusion: { in: Gitlab::VisibilityLevel.values } validates :visibility_level, inclusion: { in: Gitlab::VisibilityLevel.values }
...@@ -62,6 +64,10 @@ class Snippet < ActiveRecord::Base ...@@ -62,6 +64,10 @@ class Snippet < ActiveRecord::Base
file_name file_name
end end
def sanitized_file_name
file_name.gsub(/[^a-zA-Z0-9_\-\.]+/, '')
end
def mode def mode
nil nil
end end
......
...@@ -5,10 +5,14 @@ FactoryGirl.define do ...@@ -5,10 +5,14 @@ FactoryGirl.define do
Faker::Lorem.sentence Faker::Lorem.sentence
end end
sequence :name, aliases: [:file_name] do sequence :name do
Faker::Name.name Faker::Name.name
end end
sequence :file_name do
Faker::Internet.user_name
end
sequence(:url) { Faker::Internet.uri('http') } sequence(:url) { Faker::Internet.uri('http') }
factory :user, aliases: [:author, :assignee, :owner, :creator] do factory :user, aliases: [:author, :assignee, :owner, :creator] do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment