Release asset link cannot be created when domain name is not resolvable

Problem

Release asset link provides users to set any links to a release object. Currently, users cannot add a link if it's unresolvable domain due to the recent security patch. For example,

shinya@shinya-MS-7A34:~/workspace/thin-gdk/service/rails/src$ curl --header 'Content-Type: application/json' --header "PRIVATE-TOKEN: DM2onNmmy-EieA831AzH" \
>      --data '{ "name": "New release", "tag_name": "v0.3", "ref": "master", "description": "Super nice release", "milestone": "v1.0-rc", "assets": { "links": [{ "name": "hoge", "url": "https://hogeeeeeeee.com" }] } }' \
>      --request POST https://gitlab.com/api/v4/projects/14111764/releases

{"message":"Validation failed: Links url is blocked: Host cannot be resolved or invalid"}

Similarly, we're currently having a problem that users cannot create environment objects https://gitlab.com/gitlab-org/gitlab-ce/issues/66723. This could be disruptive behavior for some users/customers.

Since these links are just rendered in UI and GitLab itself never directly accesses it, we can allow it as-is per this comment.

FYI, if the link is an external link (regardless of its resolvable or unresolvable), GitLab shows an annotation that it's an external one for gaining an awereness of a security risk in the destination.

screenshot_21

Edited Sep 05, 2019 by Shinya Maeda
Assignee Loading
Time tracking Loading