Skip to content

Validate filename for json schema validator

Max Orefice requested to merge mo-add-regex-validation-json-schema into master

Part of #219506 (closed)

What does this MR do?

Following up !32991 (merged) where we introduced our new JSON schema validator.

@ahegyi suggested to add regex support in order to avoid path traversal.

Can we introduce some kind of convention for the filename to avoid path traversal?

This MR adds filename validation for it.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Max Orefice

Merge request reports