diff --git a/gems/gitlab-utils/lib/gitlab/utils.rb b/gems/gitlab-utils/lib/gitlab/utils.rb index d5a514bfae8c1ab362347b2c2fc4a6bc6ec894c6..51bdb897a15f78bf40370d42583386a2368570c7 100644 --- a/gems/gitlab-utils/lib/gitlab/utils.rb +++ b/gems/gitlab-utils/lib/gitlab/utils.rb @@ -11,10 +11,8 @@ module Utils ConcurrentRubyThreadIsUsedError = Class.new(StandardError) def allowlisted?(absolute_path, allowlist) - path = absolute_path.downcase - - allowlist.map(&:downcase).any? do |allowed_path| - path.start_with?(allowed_path) + allowlist.any? do |allowed_path| + absolute_path.start_with?(allowed_path) end end diff --git a/gems/gitlab-utils/spec/gitlab/utils_spec.rb b/gems/gitlab-utils/spec/gitlab/utils_spec.rb index 02d288acedfce2d2ca3d4055dce1dfa8910dcab6..e39e228ba8db381d86053dc63da50511586aad4f 100644 --- a/gems/gitlab-utils/spec/gitlab/utils_spec.rb +++ b/gems/gitlab-utils/spec/gitlab/utils_spec.rb @@ -21,6 +21,10 @@ it 'returns false if path is not allowed' do expect(allowlisted?('/test/test', allowed_paths)).to be(false) end + + it 'returns false if path is in different case' do + expect(allowlisted?('/Foo/bar', allowed_paths)).to be(false) + end end describe '.decode_path' do