Skip to content

Logs when potential path traversal attempt detected

nobody requested to merge (removed):255184 into master

What does this MR do and why?

Describe in detail what your merge request does and why.

This MR has addressed issue #255184 (closed). It added a warning log to application.log file when there is any path traversal detected.

I have tested this works on local dev.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. tail -f  application.log

  2. cd gitlab    bundle exec rails console

    Loading development environment (Rails 6.1.4.6)

    [1] pry(main)> Gitlab::Utils.check_path_traversal!('..')

  3. check application.log,

2022-02-22T06:40:40.178Z: {:message=>"Invalid path detected!", :path=>".."}

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by nobody

Merge request reports