From cebb74a0c0575f00f8904b204559979486fc714f Mon Sep 17 00:00:00 2001
From: Douwe Maan <douwe@gitlab.com>
Date: Sat, 11 Apr 2015 11:37:58 +0200
Subject: [PATCH 1/2] Fix project import URL regex to prevent arbitary local
 repos from being imported.

---
 CHANGELOG             | 1 +
 app/models/project.rb | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 0878c03207..f69f7471a5 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
 Please view this file on the master branch, on stable branches it's out of date.
 
 v 7.10.0 (unreleased)
+  - Fix project import URL regex to prevent arbitary local repos from being imported.
   - Fix bug where Wiki pages that included a '/' were no longer accessible (Stan Hu)
   - Fix bug where error messages from Dropzone would not be displayed on the issues page (Stan Hu)
   - Add ability to configure Reply-To address in gitlab.yml (Stan Hu)
diff --git a/app/models/project.rb b/app/models/project.rb
index 79572f255d..d7712e6457 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -137,7 +137,7 @@ class Project < ActiveRecord::Base
   validates_uniqueness_of :name, scope: :namespace_id
   validates_uniqueness_of :path, scope: :namespace_id
   validates :import_url,
-    format: { with: URI::regexp(%w(ssh git http https)), message: 'should be a valid url' },
+    format: { with: /\A#{URI.regexp(%w(ssh git http https))}\z/, message: 'should be a valid url' },
     if: :import?
   validates :star_count, numericality: { greater_than_or_equal_to: 0 }
   validate :check_limit, on: :create

From 9e52a2dcaba58f6bf4ce7c9858951e1936d73740 Mon Sep 17 00:00:00 2001
From: Douwe Maan <douwe@gitlab.com>
Date: Sat, 11 Apr 2015 11:38:14 +0200
Subject: [PATCH 2/2] Don't use URI.regexp to validate since it doens't have
 start/end anchors.

---
 app/models/application_setting.rb                    | 2 +-
 app/models/hooks/web_hook.rb                         | 2 +-
 app/models/project_services/bamboo_service.rb        | 2 +-
 app/models/project_services/external_wiki_service.rb | 2 +-
 app/models/project_services/teamcity_service.rb      | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index 6e98c4c2f0..0d8365c4ff 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -24,7 +24,7 @@ class ApplicationSetting < ActiveRecord::Base
 
   validates :home_page_url,
     allow_blank: true,
-    format: { with: URI::regexp(%w(http https)), message: "should be a valid url" },
+    format: { with: /\A#{URI.regexp(%w(http https))}\z/, message: "should be a valid url" },
     if: :home_page_url_column_exist
 
   validates_each :restricted_visibility_levels do |record, attr, value|
diff --git a/app/models/hooks/web_hook.rb b/app/models/hooks/web_hook.rb
index defef7216f..315d96af1b 100644
--- a/app/models/hooks/web_hook.rb
+++ b/app/models/hooks/web_hook.rb
@@ -28,7 +28,7 @@ class WebHook < ActiveRecord::Base
   default_timeout Gitlab.config.gitlab.webhook_timeout
 
   validates :url, presence: true,
-                  format: { with: URI::regexp(%w(http https)), message: "should be a valid url" }
+                  format: { with: /\A#{URI.regexp(%w(http https))}\z/, message: "should be a valid url" }
 
   def execute(data)
     parsed_url = URI.parse(url)
diff --git a/app/models/project_services/bamboo_service.rb b/app/models/project_services/bamboo_service.rb
index f968afe9fa..d8aedbd2ab 100644
--- a/app/models/project_services/bamboo_service.rb
+++ b/app/models/project_services/bamboo_service.rb
@@ -25,7 +25,7 @@ class BambooService < CiService
 
   validates :bamboo_url,
     presence: true,
-    format: { with: URI::regexp },
+    format: { with: /\A#{URI.regexp}\z/ },
     if: :activated?
   validates :build_key, presence: true, if: :activated?
   validates :username,
diff --git a/app/models/project_services/external_wiki_service.rb b/app/models/project_services/external_wiki_service.rb
index e521186798..a199d0e86f 100644
--- a/app/models/project_services/external_wiki_service.rb
+++ b/app/models/project_services/external_wiki_service.rb
@@ -18,7 +18,7 @@ class ExternalWikiService < Service
   prop_accessor :external_wiki_url
   validates :external_wiki_url,
             presence: true,
-            format: { with: URI::regexp },
+            format: { with: /\A#{URI.regexp}\z/ },
             if: :activated?
 
   def title
diff --git a/app/models/project_services/teamcity_service.rb b/app/models/project_services/teamcity_service.rb
index c26bc55135..3c002a1634 100644
--- a/app/models/project_services/teamcity_service.rb
+++ b/app/models/project_services/teamcity_service.rb
@@ -25,7 +25,7 @@ class TeamcityService < CiService
 
   validates :teamcity_url,
     presence: true,
-    format: { with: URI::regexp }, if: :activated?
+    format: { with: /\A#{URI.regexp}\z/ }, if: :activated?
   validates :build_type, presence: true, if: :activated?
   validates :username,
     presence: true,