Skip to content

fix: reject requests with very long URIs

Vladimir Shushlin requested to merge uri-len-limit into master

What does this MR do?

Fixes https://gitlab.com/gitlab-org/gitlab-pages/-/issues/659

Alternative solution is https://gitlab.com/gitlab-org/security/gitlab-pages/-/merge_requests/17.

But:

  1. I think it's useful to have a configurable switch. If self-managed clients see any errors, they can just change the flag.
  2. We found an issue specific to auth workflow, but I think other parts of the application may be vulnerable as well. If we limit the size of the URI globally, we prevent other issues.

TODO

Edited by Vladimir Shushlin

Merge request reports