diff options
| author | Stan Hu <stanhu@gmail.com> | 2018-10-23 14:59:00 -0700 |
|---|---|---|
| committer | Stan Hu <stanhu@gmail.com> | 2018-10-23 20:47:38 -0700 |
| commit | a12d25d8a5e95ef868370e7c09e777237047366b (patch) | |
| tree | e9c7054cddccca198a8f09a79f1ed8990eb73331 /lib/api/snippets.rb | |
| parent | a310a638db037d3914cf12e580c7a41209d2d06e (diff) | |
| download | gitlab-ce-a12d25d8a5e95ef868370e7c09e777237047366b.tar.gz | |
Validate Wiki attachments are valid temporary files
A malicious attacker could craft a request to read arbitrary files on
the system. This change adds a Grape validation to ensure that the
tempfile parameter delivered by the Rack multipart uploader is a
Tempfile type to prevent users from being able to specify arbitrary
filenames.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/53072
Diffstat (limited to 'lib/api/snippets.rb')
0 files changed, 0 insertions, 0 deletions