Blocked IP address can still get the whole repo by using Run CI/CD for external repository to connect IP restricted repository
HackerOne report #1941803 by ali_shehab
on 2023-04-11, assigned to @dcouture:
Original report hidden, simpler repro below
Report
Summary
Hi team, hope you are well. You may block IP address because you only want this repo to be accessible by a specific IP address. However, it is still possible to get the whole repo with all its files by connecting to the repo while creating the project.
Steps To Reproduce
- Create 2 accounts A and B.
- Login from account A.
- Create a group with an ultimate trail and create a project inside the group.
- Now add any files in the project.
- Go to group => settings => permission group and features and restrict ip address of account B.
- Now log in from account B and try to access the project created by the group.
- You will get 404 as your IP address is blocked, however, you can still see the project repo by the following steps.
- Now go to create a project and choose
Run CI/CD for external repository
- Create the project.
- you will be able to all the files of the repo although your IP address was blocked.
Impact
A user that his ip is restricted can still view the repo of the project.
How To Reproduce
Please add reproducibility information to this section:
- Create a public group and restrict IP address in the settings
- Create a public project under it
- `git clone .git
Try it with git clone https://gitlab.com/repro_1941803/test.git
Edited by Dominic Couture