Merge branch 'security-fixes-release-asset-link-filepath-ReDoS' into 'master'

Fixes release asset link filepath ReDoS

See merge request gitlab-org/security/gitlab!924

app/models/releases/link.rb

@@ -6,7 +6,9 @@ module Releases
 
     belongs_to :release
 
-    FILEPATH_REGEX = %r{\A/(?:[\-\.\w]+/?)*[\da-zA-Z]+\z}.freeze
+    # See https://gitlab.com/gitlab-org/gitlab/-/issues/218753
+    # Regex modified to prevent catastrophic backtracking
+    FILEPATH_REGEX = %r{\A\/[^\/](?!.*\/\/.*)[\-\.\w\/]+[\da-zA-Z]+\z}.freeze
 
     validates :url, presence: true, addressable_url: { schemes: %w(http https ftp) }, uniqueness: { scope: :release }
     validates :name, presence: true, uniqueness: { scope: :release }

changelogs/unreleased/security-fixes-release-asset-link-filepath-ReDoS.yml

+---
+title: Fixes release asset link filepath ReDoS
+merge_request:
+author:
+type: security