Skip to content
代码片段 群组 项目
  • Stan Hu's avatar
    e8190bd3
    Skip IP lookups in validating URLs on certain conditions · e8190bd3
    Stan Hu 创作于
    Previously anytime `ApplicationSetting` were updated `UrlBlocker`
    would attempt to resolve the IPs and determine whether they were
    allowed by the current settings. However, in an offline environment,
    services like Diagrams.net may not be resolved even if they are
    enabled by default.
    
    This commit skips the validations that require resolving IP addresses
    if there are no restrictions on outgoing requests:
    
    - Allow requests to the local network is checked
    - Allow requests to the local network from system hooks is checked
    - DNS rebinding attack protection is disabled
    - Block all requests, except for IP addresses, IP ranges, and domain
      names defined in the allowlist (`deny_all_requests_except_allowed`)
      is disabled
    
    Note that the URL validators in `ApplicationSetting` only pass in the
    current `deny_all_requests_except_allowed` setting, so if that is
    active then IP resolution will occur.
    
    Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/467524
    
    Changelog: fixed
    未验证
    e8190bd3
    历史
    Skip IP lookups in validating URLs on certain conditions
    Stan Hu 创作于
    Previously anytime `ApplicationSetting` were updated `UrlBlocker`
    would attempt to resolve the IPs and determine whether they were
    allowed by the current settings. However, in an offline environment,
    services like Diagrams.net may not be resolved even if they are
    enabled by default.
    
    This commit skips the validations that require resolving IP addresses
    if there are no restrictions on outgoing requests:
    
    - Allow requests to the local network is checked
    - Allow requests to the local network from system hooks is checked
    - DNS rebinding attack protection is disabled
    - Block all requests, except for IP addresses, IP ranges, and domain
      names defined in the allowlist (`deny_all_requests_except_allowed`)
      is disabled
    
    Note that the URL validators in `ApplicationSetting` only pass in the
    current `deny_all_requests_except_allowed` setting, so if that is
    active then IP resolution will occur.
    
    Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/467524
    
    Changelog: fixed
代码所有者
将用户和群组指定为特定文件更改的核准人。 了解更多。
此项目使用Bundler管理其依赖关系. 进一步了解
Gemfile.lock 5.15 KiB