2017-08-17 22:00:37 +05:30
|
|
|
# ImportableUrlValidator
|
|
|
|
|
#
|
|
|
|
|
# This validator blocks projects from using dangerous import_urls to help
|
|
|
|
|
# protect against Server-side Request Forgery (SSRF).
|
|
|
|
|
class ImportableUrlValidator < ActiveModel::EachValidator
|
|
|
|
|
def validate_each(record, attribute, value)
|
2018-03-26 14:24:53 +05:30
|
|
|
if Gitlab::UrlBlocker.blocked_url?(value, valid_ports: Project::VALID_IMPORT_PORTS)
|
2017-08-17 22:00:37 +05:30
|
|
|
record.errors.add(attribute, "imports are not allowed from that URL")
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
end
|
