Are users safe to use GFM in alert payload?

Problem

In https://gitlab.slack.com/archives/CK06WE78S/p1591112806038100 (internal) @smcgivern linked a suspicious log entry for a firing alert processed by IncidentManagement::ProcessAlertWorker.

https://log.gprd.gitlab.net/app/kibana#/doc/AWNABDRwNDuQHTm2tH6l/pubsub-sidekiq-inf-gprd-000963?id=ZxyAc3IBW7zItTSCzSAQ&_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-7d,to:now))

Note

"description"=>"![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../etc/passwd)"

Question

Is GitLab's Alert (~"Category:Alert Management", Category:Incident Management) functionality vulnerable to GitLab Flavored Markdown (GFM) some kind of attacks (here path traversal).

Assumption

We are safe.

An incoming alert payload can trigger the following actions:

• Via Prometheus alert endpoint and the Prometheus::NotifyService
  • ✔ Create alerts for ~"Category:Alert Management" via AlertManagement::ProcessPrometheusAlertService which does not support GFM (yet)
  • ✔ Persist alert events via Alerts::CreateEventsService which not storing the actual content but just the project id and fingerprint
  • ✔ Send emails via prometheus_alerts_fired which does not support GFM
  • ✔ Create issues for Category:Incident Management via IncidentManagement::ProcessPrometheusAlertWorker which passes title and description to Issue which support the complete and safe GFM pipeline
• Via Generic alert endpoint and Alerting::NotifyService
  • ✔ Send emails via prometheus_alerts_fired which does not support GFM
  • ✔ Uses IncidentManagement::ProcessAlertWorker to
    • Create alerts for ~"Category:Alert Management" which does not support GFM (yet)
    • Create issue for Category:Incident Management which passes title and description to Issue which support the complete and safe GFM pipeline

Proof

Via https://gitlab.com/gitlab-org/monitor/tanuki-inc/.

Alert Management	Issue	Email
no GFM support	malicious link pointing to https://gitlab.com/path/traversal	no GFM support