Permalink
Browse files

Merge branch 'security-fj-crlf-injection' into 'master'

[master] Fix CRLF issue in UrlValidator

See merge request gitlab/gitlabhq!2627
  • Loading branch information...
cindy committed Nov 28, 2018
1 parent fe5f759 commit c0e5d9afee57745a79c072b0f57fdcbe164312da
@@ -0,0 +1,5 @@
---
title: Fix CRLF vulnerability in Project hooks
merge_request:
author:
type: security
@@ -10,11 +10,8 @@ class << self
def validate!(url, allow_localhost: false, allow_local_network: true, enforce_user: false, ports: [], protocols: [])
return true if url.nil?

begin
uri = Addressable::URI.parse(url)
rescue Addressable::URI::InvalidURIError
raise BlockedUrlError, "URI is invalid"
end
# Param url can be a string, URI or Addressable::URI
uri = parse_url(url)

# Allow imports from the GitLab instance itself but only from the configured ports
return true if internal?(uri)
@@ -49,6 +46,18 @@ def blocked_url?(*args)

private

def parse_url(url)
raise Addressable::URI::InvalidURIError if multiline?(url)

Addressable::URI.parse(url)
rescue Addressable::URI::InvalidURIError, URI::InvalidURIError
raise BlockedUrlError, 'URI is invalid'
end

def multiline?(url)
CGI.unescape(url.to_s) =~ /\n|\r/
end

def validate_port!(port, ports)
return if port.blank?
# Only ports under 1024 are restricted
@@ -218,76 +218,93 @@
end
end

it 'does not allow an invalid URI as import_url' do
project = build(:project, import_url: 'invalid://')
describe 'import_url' do
it 'does not allow an invalid URI as import_url' do
project = build(:project, import_url: 'invalid://')

expect(project).not_to be_valid
end
expect(project).not_to be_valid
end

it 'does allow a SSH URI as import_url for persisted projects' do
project = create(:project)
project.import_url = 'ssh://test@gitlab.com/project.git'
it 'does allow a SSH URI as import_url for persisted projects' do
project = create(:project)
project.import_url = 'ssh://test@gitlab.com/project.git'

expect(project).to be_valid
end
expect(project).to be_valid
end

it 'does not allow a SSH URI as import_url for new projects' do
project = build(:project, import_url: 'ssh://test@gitlab.com/project.git')
it 'does not allow a SSH URI as import_url for new projects' do
project = build(:project, import_url: 'ssh://test@gitlab.com/project.git')

expect(project).not_to be_valid
end
expect(project).not_to be_valid
end

it 'does allow a valid URI as import_url' do
project = build(:project, import_url: 'http://gitlab.com/project.git')
it 'does allow a valid URI as import_url' do
project = build(:project, import_url: 'http://gitlab.com/project.git')

expect(project).to be_valid
end
expect(project).to be_valid
end

it 'allows an empty URI' do
project = build(:project, import_url: '')
it 'allows an empty URI' do
project = build(:project, import_url: '')

expect(project).to be_valid
end
expect(project).to be_valid
end

it 'does not produce import data on an empty URI' do
project = build(:project, import_url: '')
it 'does not produce import data on an empty URI' do
project = build(:project, import_url: '')

expect(project.import_data).to be_nil
end
expect(project.import_data).to be_nil
end

it 'does not produce import data on an invalid URI' do
project = build(:project, import_url: 'test://')
it 'does not produce import data on an invalid URI' do
project = build(:project, import_url: 'test://')

expect(project.import_data).to be_nil
end
expect(project.import_data).to be_nil
end

it "does not allow import_url pointing to localhost" do
project = build(:project, import_url: 'http://localhost:9000/t.git')
it "does not allow import_url pointing to localhost" do
project = build(:project, import_url: 'http://localhost:9000/t.git')

expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Requests to localhost are not allowed')
end
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Requests to localhost are not allowed')
end

it "does not allow import_url with invalid ports for new projects" do
project = build(:project, import_url: 'http://github.com:25/t.git')
it "does not allow import_url with invalid ports for new projects" do
project = build(:project, import_url: 'http://github.com:25/t.git')

expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 80, 443')
end
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 80, 443')
end

it "does not allow import_url with invalid ports for persisted projects" do
project = create(:project)
project.import_url = 'http://github.com:25/t.git'
it "does not allow import_url with invalid ports for persisted projects" do
project = create(:project)
project.import_url = 'http://github.com:25/t.git'

expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 22, 80, 443')
end
expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Only allowed ports are 22, 80, 443')
end

it "does not allow import_url with invalid user" do
project = build(:project, import_url: 'http://$user:password@github.com/t.git')

expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Username needs to start with an alphanumeric character')
end

it "does not allow import_url with invalid user" do
project = build(:project, import_url: 'http://$user:password@github.com/t.git')
include_context 'invalid urls'

expect(project).to be_invalid
expect(project.errors[:import_url].first).to include('Username needs to start with an alphanumeric character')
it 'does not allow urls with CR or LF characters' do
project = build(:project)

aggregate_failures do
urls_with_CRLF.each do |url|
project.import_url = url

expect(project).not_to be_valid
expect(project.errors.full_messages.first).to match(/is blocked: URI is invalid/)
end
end
end
end

describe 'project pending deletion' do
@@ -0,0 +1,17 @@
shared_context 'invalid urls' do
let(:urls_with_CRLF) do
["http://127.0.0.1:333/pa\rth",
"http://127.0.0.1:333/pa\nth",
"http://127.0a.0.1:333/pa\r\nth",
"http://127.0.0.1:333/path?param=foo\r\nbar",
"http://127.0.0.1:333/path?param=foo\rbar",
"http://127.0.0.1:333/path?param=foo\nbar",
"http://127.0.0.1:333/pa%0dth",
"http://127.0.0.1:333/pa%0ath",
"http://127.0a.0.1:333/pa%0d%0th",
"http://127.0.0.1:333/pa%0D%0Ath",
"http://127.0.0.1:333/path?param=foo%0Abar",
"http://127.0.0.1:333/path?param=foo%0Dbar",
"http://127.0.0.1:333/path?param=foo%0D%0Abar"]
end
end
@@ -1,3 +1,5 @@
# frozen_string_literal: true

require 'spec_helper'

describe UrlValidator do
@@ -6,6 +8,30 @@

include_examples 'url validator examples', described_class::DEFAULT_PROTOCOLS

describe 'validations' do
include_context 'invalid urls'

let(:validator) { described_class.new(attributes: [:link_url]) }

it 'returns error when url is nil' do
expect(validator.validate_each(badge, :link_url, nil)).to be_nil
expect(badge.errors.first[1]).to eq 'must be a valid URL'
end

it 'returns error when url is empty' do
expect(validator.validate_each(badge, :link_url, '')).to be_nil
expect(badge.errors.first[1]).to eq 'must be a valid URL'
end

it 'does not allow urls with CR or LF characters' do
aggregate_failures do
urls_with_CRLF.each do |url|
expect(validator.validate_each(badge, :link_url, url)[0]).to eq 'is blocked: URI is invalid'
end
end
end
end

context 'by default' do
let(:validator) { described_class.new(attributes: [:link_url]) }

0 comments on commit c0e5d9a

Please sign in to comment.