debian-mirror-gitlab/lib/gitlab/url_sanitizer.rb

100 lines
2.5 KiB
Ruby
Raw Normal View History

2018-12-13 13:39:08 +05:30
# frozen_string_literal: true
2016-06-02 11:05:42 +05:30
module Gitlab
class UrlSanitizer
2018-03-17 18:26:18 +05:30
ALLOWED_SCHEMES = %w[http https ssh git].freeze
2016-06-02 11:05:42 +05:30
def self.sanitize(content)
2018-12-05 23:21:45 +05:30
regexp = URI::DEFAULT_PARSER.make_regexp(ALLOWED_SCHEMES)
2016-06-02 11:05:42 +05:30
content.gsub(regexp) { |url| new(url).masked_url }
2016-08-24 12:49:21 +05:30
rescue Addressable::URI::InvalidURIError
content.gsub(regexp, '')
end
def self.valid?(url)
2018-03-17 18:26:18 +05:30
return false unless url.present?
2018-12-23 12:14:25 +05:30
return false unless url.is_a?(String)
2017-08-17 22:00:37 +05:30
2018-03-17 18:26:18 +05:30
uri = Addressable::URI.parse(url.strip)
2016-08-24 12:49:21 +05:30
2018-03-17 18:26:18 +05:30
ALLOWED_SCHEMES.include?(uri.scheme)
2016-08-24 12:49:21 +05:30
rescue Addressable::URI::InvalidURIError
false
2016-06-02 11:05:42 +05:30
end
def initialize(url, credentials: nil)
2018-03-17 18:26:18 +05:30
%i[user password].each do |symbol|
credentials[symbol] = credentials[symbol].presence if credentials&.key?(symbol)
end
2016-06-02 11:05:42 +05:30
@credentials = credentials
2018-03-17 18:26:18 +05:30
@url = parse_url(url)
2016-06-02 11:05:42 +05:30
end
def sanitized_url
@sanitized_url ||= safe_url.to_s
end
def masked_url
url = @url.dup
2018-03-17 18:26:18 +05:30
url.password = "*****" if url.password.present?
url.user = "*****" if url.user.present?
2016-06-02 11:05:42 +05:30
url.to_s
end
def credentials
2018-03-17 18:26:18 +05:30
@credentials ||= { user: @url.user.presence, password: @url.password.presence }
2016-06-02 11:05:42 +05:30
end
def full_url
@full_url ||= generate_full_url.to_s
end
private
2018-03-17 18:26:18 +05:30
def parse_url(url)
url = url.to_s.strip
match = url.match(%r{\A(?:git|ssh|http(?:s?))\://(?:(.+)(?:@))?(.+)})
raw_credentials = match[1] if match
if raw_credentials.present?
url.sub!("#{raw_credentials}@", '')
2018-11-18 11:00:15 +05:30
user, _, password = raw_credentials.partition(':')
2018-03-17 18:26:18 +05:30
@credentials ||= { user: user.presence, password: password.presence }
end
url = Addressable::URI.parse(url)
url.password = password if password.present?
url.user = user if user.present?
url
end
2016-06-02 11:05:42 +05:30
def generate_full_url
return @url unless valid_credentials?
2018-03-17 18:26:18 +05:30
2018-11-18 11:00:15 +05:30
@url.dup.tap do |generated|
generated.password = encode_percent(credentials[:password]) if credentials[:password].present?
generated.user = encode_percent(credentials[:user]) if credentials[:user].present?
end
2016-06-02 11:05:42 +05:30
end
def safe_url
safe_url = @url.dup
safe_url.password = nil
safe_url.user = nil
safe_url
end
def valid_credentials?
credentials && credentials.is_a?(Hash) && credentials.any?
end
2018-11-18 11:00:15 +05:30
def encode_percent(string)
# CGI.escape converts spaces to +, but this doesn't work for git clone
CGI.escape(string).gsub('+', '%20')
end
2016-06-02 11:05:42 +05:30
end
end