Commit 496c3612 authored by Małgorzata Ksionek's avatar Małgorzata Ksionek

Add other method to handle strings middleware

parent c3ebc8a1
...@@ -61,7 +61,7 @@ module Gitlab ...@@ -61,7 +61,7 @@ module Gitlab
return false unless credentials return false unless credentials
string_malformed?(credentials) credentials_string_malformed?(credentials)
end end
def param_has_null_byte?(value, depth = 0) def param_has_null_byte?(value, depth = 0)
...@@ -98,6 +98,13 @@ module Gitlab ...@@ -98,6 +98,13 @@ module Gitlab
# If we're here, we caught a malformed string. Return true # If we're here, we caught a malformed string. Return true
true true
end end
def credentials_string_malformed?(string)
string.force_encoding('UTF-8').match?(NULL_BYTE_REGEX)
rescue ArgumentError, Encoding::UndefinedConversionError
# If we're here, we caught a malformed string. Return true
true
end
end end
end end
end end
# frozen_string_literal: true
require 'spec_helper' require 'spec_helper'
require "rack/test" require "rack/test"
...@@ -104,6 +103,12 @@ RSpec.describe Gitlab::Middleware::HandleMalformedStrings do ...@@ -104,6 +103,12 @@ RSpec.describe Gitlab::Middleware::HandleMalformedStrings do
expect(subject.call(env)).not_to eq error_400 expect(subject.call(env)).not_to eq error_400
end end
it 'does not reject correct encoded password with special characters' do
env = env_for.merge(auth_env("username", "RçKszEwéC5kFnû∆f243fycGu§Gh9ftDj!U", nil))
expect(subject.call(env)).not_to eq error_400
end
end end
context 'in params' do context 'in params' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment