[ci skip]

GitLab Release Tools Bot authored 5 years ago and John Skarbek committed 5 years ago

Server Side Request Forgery mitigation bypass

Closes #2872

See merge request gitlab/gitlabhq!3205

When we can't resolve the hostname or it is invalid, we shouldn't
even perform the request. This fix also fixes the problem the
SSRF rebinding attack.

We can't stub feature flags outside example blocks. Nevertheless,
there are some actions that calls the UrlBlocker, that are performed
outside example blocks, ie: `set` instruction.

That's why we have to use some signalign mechanism outside the scope
of the specs.