Skip to content
Snippets Groups Projects

Update --extra-index-url usage in repository webpages

Merged Update --extra-index-url usage in repository webpages
usdResponsibleDisclosure/gitlab:384253-fix-possible-dependency-confusion-pypi into master
All threads resolved!
Merged usdResponsibleDisclosure requested to merge usdResponsibleDisclosure/gitlab:384253-fix-possible-dependency-confusion-pypi into master
All threads resolved!
Viewing commit 344bd529
Prev
Show latest version
1 file
+ 1
− 1
Compare changes
  • Side-by-side
  • Inline
  • 344bd529 
    If applied, this commit will apply suggestion 1 as seen in
#384253

This change is being made as to prevent users from using
--extra-index-url without understanding
the security implications of this command
spec/frontend/packages_and_registries/package_registry/components/details/__snapshots__/pypi_installation_spec.js.snap
+ 1
− 1
@@ -114,7 +114,7 @@ exports[`PypiInstallation renders all the messages 1`] = `
@@ -114,7 +114,7 @@ exports[`PypiInstallation renders all the messages 1`] = `
aria-live="polite"
aria-live="polite"
class="btn input-group-text btn-default btn-md gl-button btn-default-secondary btn-icon"
class="btn input-group-text btn-default btn-md gl-button btn-default-secondary btn-icon"
data-clipboard-handle-tooltip="false"
data-clipboard-handle-tooltip="false"
data-clipboard-text="pip install @gitlab-org/package-15 --extra-index-url http://__token__:<your_personal_token>@gdk.test:3000/api/v4/projects/1/packages/pypi/simple"
data-clipboard-text="pip install @gitlab-org/package-15 --index-url http://__token__:<your_personal_token>@gdk.test:3000/api/v4/projects/1/packages/pypi/simple"
id="clipboard-button-6"
id="clipboard-button-6"
title="Copy Pip command"
title="Copy Pip command"
type="button"
type="button"