2017-08-17 22:00:37 +05:30
|
|
|
# ImportableUrlValidator
|
|
|
|
|
#
|
|
|
|
|
# This validator blocks projects from using dangerous import_urls to help
|
|
|
|
|
# protect against Server-side Request Forgery (SSRF).
|
|
|
|
|
class ImportableUrlValidator < ActiveModel::EachValidator
|
|
|
|
|
def validate_each(record, attribute, value)
|
2018-05-09 12:01:36 +05:30
|
|
|
Gitlab::UrlBlocker.validate!(value, valid_ports: Project::VALID_IMPORT_PORTS)
|
|
|
|
|
rescue Gitlab::UrlBlocker::BlockedUrlError => e
|
|
|
|
|
record.errors.add(attribute, "is blocked: #{e.message}")
|
2017-08-17 22:00:37 +05:30
|
|
|
end
|
|
|
|
|
end
|
