lib/gitlab/url_blocker.rb
# Validates the given url according to the constraints specified by arguments.
#
# ports - Raises error if the given URL port does is not between given ports.
# allow_localhost - Raises error if URL resolves to a localhost IP address and argument is true.
# allow_local_network - Raises error if URL resolves to a link-local address and argument is true.
# ascii_only - Raises error if URL has unicode characters and argument is true.
# enforce_user - Raises error if URL user doesn't start with alphanumeric characters and argument is true.
# enforce_sanitization - Raises error if URL includes any HTML/CSS/JS tags and argument is true.
#
# Returns an array with [<uri>, <original-hostname>].
# rubocop:disable Metrics/ParameterLists
Validates the given url according to the constraints specified by arguments.
ports - Raises error if the given URL port does is not between given ports.
allow_localhost - Raises error if URL resolves to a localhost IP address and argument is true.
allow_local_network - Raises error if URL resolves to a link-local address and argument is true.
ascii_only - Raises error if URL has unicode characters and argument is true.
enforce_user - Raises error if URL user doesn't start with alphanumeric characters and argument is true.
enforce_sanitization - Raises error if URL includes any HTML/CSS/JS tags and argument is true.

Returns an array with [, ].
Validates the given url according to the constraints specified by arguments . ports - Raises error if the given URL port does is not between given ports . allow_localhost - Raises error if URL resolves to a localhost IP address and argument is true . allow_local_network - Raises error if URL resolves to a link - local address and argument is true . ascii_only - Raises error if URL has unicode characters and argument is true . enforce_user - Raises error if URL user doesn ' t start with alphanumeric characters and argument is true . enforce_sanitization - Raises error if URL includes any HTML / CSS / JS tags and argument is true . Returns an array with [ ] .
def validate!(
        url,
        ports: [],
        schemes: [],
        allow_localhost: false,
        allow_local_network: true,
        ascii_only: false,
        enforce_user: false,
        enforce_sanitization: false,
        dns_rebind_protection: true)
        return [nil, nil] if url.nil?
        uri = parse_url(url)
        validate_uri(
          uri: uri,
          schemes: schemes,
          ports: ports,
          enforce_sanitization: enforce_sanitization,
          enforce_user: enforce_user,
          ascii_only: ascii_only
        )
        hostname = uri.hostname
        port = get_port(uri)
        address_info = get_address_info(hostname, port)
        return [uri, nil] unless address_info
        protected_uri_with_hostname = enforce_uri_hostname(address_info, uri, hostname, dns_rebind_protection)
        return protected_uri_with_hostname if internal?(uri)
        validate_local_request(
          address_info: address_info,
          allow_localhost: allow_localhost,
          allow_local_network: allow_local_network
        )
        protected_uri_with_hostname
      end
def validate! ( url , ports : [ ] , schemes : [ ] , allow_localhost : false , allow_local_network : true , ascii_only : false , enforce_user : false , enforce_sanitization : false , dns_rebind_protection : true ) return [ nil , nil ] if url . nil? uri = parse_url ( url ) validate_uri ( uri : uri , schemes : schemes , ports : ports , enforce_sanitization : enforce_sanitization , enforce_user : enforce_user , ascii_only : ascii_only ) hostname = uri . hostname port = get_port ( uri ) address_info = get_address_info ( hostname , port ) return [ uri , nil ] unless address_info protected_uri_with_hostname = enforce_uri_hostname ( address_info , uri , hostname , dns_rebind_protection ) return protected_uri_with_hostname if internal? ( uri ) validate_local_request ( address_info : address_info , allow_localhost : allow_localhost , allow_local_network : allow_local_network ) protected_uri_with_hostname end
Validates the given url according to the constraints specified by arguments.
Validates the given url according to the constraints specified by arguments .
# rubocop:enable Metrics/ParameterLists # Param url can be a string, URI or Addressable::URI # Allow url from the GitLab instance itself but only for the configured hostname and ports
url
<not_specific>
ports
<not_specific>
schemes
<not_specific>
allow_localhost
<not_specific>
allow_local_network
<not_specific>
ascii_only
<not_specific>
enforce_user
<not_specific>
enforce_sanitization
<not_specific>
dns_rebind_protection
<not_specific>