SSRF in project imports with LFS

Summary

Follow-up to https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2696/diffs#note_142737 https://gitlab.com/gitlab-org/gitlab-ce/issues/55200 and https://gitlab.com/gitlab-org/gitlab-ce/issues/55229.

Steps to reproduce

When importing a project that uses LFS from elsewhere, we import the LFS object by performing a HTTP request to get the LFS object, and streaming the contents to disk.

For this we're using open-uri to service the request, which means that redirects are followed without reference to Gitlab::UrlBlocker. So, this can be used to exfiltrate data from the local network, ignoring our policies about that.

What is the current bug behavior?

HTTP requests against arbitrary targets (SSRF)

What is the expected correct behavior?

It would be good to respect the SSRF policy in application settings, so requests against local networks could be forbidden. The requirements are onerous enough to prevent exfiltration, and we're limited to GET requests, which prevents data-modifying SSRF attacks.

Output of checks

This bug happens on GitLab.com

Possible fixes

Remove open-uri.