Skip to content

Resolve ".git URL for a project responds differently if a private project exists"

Nick Thomas requested to merge 245260-fix-git-url-project-disclosure into master

What does this MR do?

If you visit /group/project.git in a web browser, you are redirected to /group/project as long as the project exists. This is a good idea, but we should only do it when a user is authorized to see the project.

Doing it unconditionally means that we leak the fact that the project exists to unauthorized users.

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #245260 (closed)

Edited by Nick Thomas

Merge request reports