From f28a12a559ef5492b583f0ae5dff5dcb49c7afe1 Mon Sep 17 00:00:00 2001
From: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Date: Fri, 12 Dec 2014 13:15:42 +0200
Subject: [PATCH] Add strict validation to snippet file names
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
---
app/models/snippet.rb | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/app/models/snippet.rb b/app/models/snippet.rb
index a47fbca3260..44fbff345b4 100644
--- a/app/models/snippet.rb
+++ b/app/models/snippet.rb
@@ -29,7 +29,9 @@ class Snippet < ActiveRecord::Base
validates :author, presence: true
validates :title, presence: true, length: { within: 0..255 }
- validates :file_name, presence: true, length: { within: 0..255 }
+ validates :file_name, presence: true, length: { within: 0..255 },
+ format: { with: Gitlab::Regex.path_regex,
+ message: Gitlab::Regex.path_regex_message }
validates :content, presence: true
validates :visibility_level, inclusion: { in: Gitlab::VisibilityLevel.values }
@@ -72,7 +74,7 @@ class Snippet < ActiveRecord::Base
def visibility_level_field
visibility_level
- end
+ end
class << self
def search(query)
--
GitLab