[ci skip]

Add DNS rebinding protection settings

See merge request gitlab/gitlabhq!3132

This was renamed in GitLab 11.11, so the backport needs to use
the original name.

Reject slug+uri concat if slug is deemed unsafe

See merge request gitlab/gitlabhq!3107

Protect Gitlab::HTTP against DNS rebinding attack

See merge request gitlab/gitlabhq!3115

Persistent XSS in note objects CE

See merge request gitlab/gitlabhq!3081

Fix url redaction for issue links

See merge request gitlab/gitlabhq!3089

Disallow invalid MR branch name

See merge request gitlab/gitlabhq!3093

Hide issue title on unsubscribe for anonymous users

See merge request gitlab/gitlabhq!3101

Fix confidential issue label disclosure on milestone view

See merge request gitlab/gitlabhq!3104

Resolve: Milestones leaked via search API

See merge request gitlab/gitlabhq!3112

Prevent password sign in restriction bypass

See merge request gitlab/gitlabhq!3119

Update Knative version due to a security vulnerability

See merge request gitlab/gitlabhq!3122

Fix project visibility level validation

See merge request gitlab/gitlabhq!3124

First reported:
  https://gitlab.com/gitlab-org/gitlab-ce/issues/60143

When the page slug is "javascript:" and we attempt to link to a relative
path (using `.` or `..`) the code will concatenate the slug and the uri.
This MR adds a guard to that concat step that will return `nil` if the
incoming slug matches against any of the "unsafe" slug regexes;
currently this is only for the slug "javascript:" but can be extended if
needed. Manually tested against a non-exhaustive list from OWASP of
common javascript XSS exploits that have to to with mangling the
"javascript:" method, and all are caught by this change or by existing
code that ingests the user-specified slug.

Replaces a hard-coded date in the job app spec

Closes #62283

See merge request gitlab-org/gitlab-ce!28709

Douwe Maan authored 5 years ago and Oswaldo Ferreir committed 5 years ago

Gitlab::HTTP now resolves the hostname only once, verifies the IP is not
blocked, and then uses the same IP to perform the actual request, while
passing the original hostname in the `Host` header and SSL SNI field.

Fix milestone titles being leaked using search API
when users cannot read milestones

Prevents refspec as branch name, which would bypass branch protection
when used in conjunction with rebase.

HEAD seems to be a special case with lots of occurrence,
so it is considered valid for now.

Another special case is `refs/head/*`, which can be imported.

[ci skip]

Disallow read user scope to read project events

See merge request gitlab/gitlabhq!3088