Merge branch 'master' into stretch-backports

CHANGELOG.md

@@ -2,6 +2,13 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 10.7.7 (2018-07-17)
+
+### Security (1 change)
+
+- Fix symlink vulnerability in project import.
+
+
 ## 10.7.6 (2018-06-21)
 
 ### Security (6 changes)

VERSION

@@ -1 +1 @@
-10.7.6
+10.7.7

debian/changelog

@@ -1,9 +1,16 @@
-gitlab (10.7.6+dfsg-2~bpo9+1) stretch-backports; urgency=medium
+gitlab (10.7.7+dfsg-1~bpo9+1) stretch-backports; urgency=medium
 
   * Rebuild for stretch-backports.
 
  -- Pirate Praveen <praveen@debian.org>  Sun, 03 Jun 2018 21:03:45 +0530
 
+gitlab (10.7.7+dfsg-1) experimental; urgency=medium
+
+  * New upstream version 10.7.7+dfsg (Fixes: CVE-2018-14364) (Closes: #904026)
+  * Bump Standards-Version to 4.2.0 (no changes needed)
+
+ -- Pirate Praveen <praveen@debian.org>  Mon, 20 Aug 2018 21:38:35 +0530
+
 gitlab (10.7.6+dfsg-2) experimental; urgency=medium
 
   * Support html-sanitizer >= 2.7.1 (see upstream issue 48415)

debian/control

@@ -6,7 +6,7 @@ Uploaders: Cédric Boutillier <boutil@debian.org>,
  Pirate Praveen <praveen@debian.org>,
  Balasankar C <balasankarc@autistici.org>
 Build-Depends: debhelper (>= 10~), gem2deb, bc
-Standards-Version: 4.1.4
+Standards-Version: 4.2.0
 Vcs-Git: https://salsa.debian.org/ruby-team/gitlab.git
 Vcs-Browser: https://salsa.debian.org/ruby-team/gitlab
 Homepage: https://about.gitlab.com/

lib/gitlab/import_export/file_importer.rb

@@ -4,6 +4,7 @@ module Gitlab
       include Gitlab::ImportExport::CommandLineUtil
 
       MAX_RETRIES = 8
+      IGNORED_FILENAMES = %w(. ..).freeze
 
       def self.import(*args)
         new(*args).import
@@ -59,7 +60,7 @@ module Gitlab
       end
 
       def extracted_files
-        Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| f =~ %r{.*/\.{1,2}$} }
+        Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| IGNORED_FILENAMES.include?(File.basename(f)) }
       end
     end
   end

spec/lib/gitlab/import_export/file_importer_spec.rb

@@ -7,6 +7,7 @@ describe Gitlab::ImportExport::FileImporter do
   let(:symlink_file) { "#{shared.export_path}/invalid.json" }
   let(:hidden_symlink_file) { "#{shared.export_path}/.hidden" }
   let(:subfolder_symlink_file) { "#{shared.export_path}/subfolder/invalid.json" }
+  let(:evil_symlink_file) { "#{shared.export_path}/.\nevil" }
 
   before do
     stub_const('Gitlab::ImportExport::FileImporter::MAX_RETRIES', 0)
@@ -34,6 +35,10 @@ describe Gitlab::ImportExport::FileImporter do
       expect(File.exist?(hidden_symlink_file)).to be false
     end
 
+    it 'removes evil symlinks in root folder' do
+      expect(File.exist?(evil_symlink_file)).to be false
+    end
+
     it 'removes symlinks in subfolders' do
       expect(File.exist?(subfolder_symlink_file)).to be false
     end
@@ -75,5 +80,7 @@ describe Gitlab::ImportExport::FileImporter do
     FileUtils.touch(valid_file)
     FileUtils.ln_s(valid_file, symlink_file)
     FileUtils.ln_s(valid_file, subfolder_symlink_file)
+    FileUtils.ln_s(valid_file, hidden_symlink_file)
+    FileUtils.ln_s(valid_file, evil_symlink_file)
   end
 end