Update net-protocol to v0.2.2
What does this MR do and why?
The monkey patches for Net::BufferedIO were extracted to the gitlab-http gem in !125024 (merged), and the gem handles the #readuntil changes for v0.2.2.
Now that Ruby 3.3 and up ship with net-protocol v0.2.1 and up, we should update to this version.
Diff: https://my.diffend.io/gems/net-protocol/0.1.2/0.2.2
References
Relates to #392378
How to validate locally
To test the net-protocol mitigations still work:
- Check out this branch.
- In
Admin->Network->Outbound requests, click onAllow requests to the local network from webhooks and integrations. - Click
Save changes. - In one terminal, spin up
netcatby running:nc -k -l 9999 - In
bin/rails console: runGitlab::HTTP.get('http://127.0.0.1:9999'). - In the
netcatterminal, response:
HTTP/1.1 200 OK
- In the same terminal, start typing slowly, one character every few seconds.
- Eventually you should see the client give up:
[3] pry(main)> Gitlab::HTTP.get('http://127.0.0.1:9999')
Errno::ECONNREFUSED: Failed to open TCP connection to 127.0.0.1:9999 (Connection refused - connect(2) for "127.0.0.1" port 9999)
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Stan Hu