[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Sanitize target branch

See merge request gitlab-org/security/gitlab!1201

Add routes for unmatched url for not-get requests

See merge request gitlab-org/security/gitlab!1125

mksionek authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

Add changelog entry

Fix typo in routes

Fix git http spec

Fix uploads routing spec

Add matchers only to project facing paths

Add more specs for new routes

Add different shared examples

Fix rubocop offence

Add failure message to new matcher

Add cr remarks

Add cr remarks

Fix DNS rebinding protection for Outbound Requests

See merge request gitlab-org/security/gitlab!1193

Filter sensitive variables from GraphQL logs

See merge request gitlab-org/security/gitlab!1187

Sanitize XSS in Epic milestone due date

See merge request gitlab-org/security/gitlab!1161

Remove Kubernetes IP address from errors returned in Threat Monitoring

See merge request gitlab-org/security/gitlab!1159

Avoid exposing release links when the user cannot read git-tag/repository

See merge request gitlab-org/security/gitlab!1169

Sanitized the target branch to prevent XSS

This fixes DNS rebinding protection bypass when allowing an IP address
in Outbound Requests setting.

This uses the same config we setup for config.filter_parameters

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Deny implicit flow for confidential apps

See merge request gitlab-org/security/gitlab!1167

This commit fixes the security vulnerability that guest
can read git-tag through release links.

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Fix prometheus DoS through Workhorse

See merge request gitlab-org/security/gitlab!1145

Deny implicit flow for confidential apps

See merge request gitlab-org/security/gitlab!1140

Set all trusted OAuth apps as confidential

See merge request gitlab-org/security/gitlab!1151

Fix regex backtracking issue in package_name_regex

See merge request gitlab-org/security/gitlab!1110

Fix stealing API token and Prometheus DoS through GitLab Pages

See merge request gitlab-org/security/gitlab!1137

vshushlin authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

it includes 2 security fixes

Update non-negative integer regex to protect against regex DoS

See merge request gitlab-org/security/gitlab!1130

Forbid public cache for private repos

See merge request gitlab-org/security/gitlab!1148

Sanitize XSS in milestone title

This fix resolves problem with leaked Kubernetes IP address in error
messages.