Skip to content

Fix incorrect regex used in FileUploader#extract_dynamic_path

What does this MR do?

In !3867 (merged) we enabled uploads stored in the uploads table to be migrated to object storage, but there are a number of entries in the uploads table with a path containing a secret of length 10. Geo is failing to sync file uploads with these secrets in the path. This MR fixes the regex used in FileUploader#extract_dynamic_path to parse properly paths with a secret containing 10-bytes or 32-bytes.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Realted issues

Closes #209940 (closed)

Edited by Yorick Peterse

Merge request reports