Commit a832e69c authored by Lucas Charles's avatar Lucas Charles

Rescue invalid URLs during badge retrieval in asset proxy

parent db0d1c9b
---
title: Rescue invalid URLs during badge retrieval in asset proxy
merge_request: 26524
author:
type: fixed
...@@ -11,12 +11,14 @@ module Gitlab ...@@ -11,12 +11,14 @@ module Gitlab
return url if asset_host_whitelisted?(url) return url if asset_host_whitelisted?(url)
"#{Gitlab.config.asset_proxy.url}/#{asset_url_hash(url)}/#{hexencode(url)}" "#{Gitlab.config.asset_proxy.url}/#{asset_url_hash(url)}/#{hexencode(url)}"
rescue Addressable::URI::InvalidURIError
url
end end
private private
def asset_host_whitelisted?(url) def asset_host_whitelisted?(url)
parsed_url = URI.parse(url) parsed_url = Addressable::URI.parse(url)
Gitlab.config.asset_proxy.domain_regexp&.match?(parsed_url.host) Gitlab.config.asset_proxy.domain_regexp&.match?(parsed_url.host)
end end
......
...@@ -33,9 +33,15 @@ describe Gitlab::AssetProxy do ...@@ -33,9 +33,15 @@ describe Gitlab::AssetProxy do
expect(described_class.proxy_url(url)).to eq(proxied_url) expect(described_class.proxy_url(url)).to eq(proxied_url)
end end
it 'returns original URL for invalid domains' do
url = 'foo_bar://'
expect(described_class.proxy_url(url)).to eq(url)
end
context 'whitelisted domain' do context 'whitelisted domain' do
it 'returns original URL for single domain whitelist' do it 'returns original URL for single domain whitelist' do
url = 'http://gitlab.com/test.png' url = 'http://gitlab.com/${default_branch}/test.png'
expect(described_class.proxy_url(url)).to eq(url) expect(described_class.proxy_url(url)).to eq(url)
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment