Determine if a revert of "Prevent SVG XSS via file preview" can be completed to mitigate issues being experienced in the Gitaly fleet
Context: https://gitlab.com/gitlab-org/gitlab/-/issues/213310, and this MR: https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/215.
This has been impacting Gitaly with a number of incidents lately, as seen here:
A number of Gitaly incidents definitely appears to be higher since this change rolled in:
Not all of these incidents are definitely related to this change, but there appears to be a correlation. Further investigation would be done, looking at the types of alerts and incidents we've seen following this change.
Definition of Done
-
A determination is made whether we can revert the code in this MR: https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/215. -
If yes, conduct the revert -
If no, define a replacement corrective action to solve for the issues present in this code.
-
Edited by Brent Newton