1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
# frozen_string_literal: true
# The Rails and Rack session stores allow developers to store arbitrary
# Ruby objects in the Hash, which gets serialized to Redis. However,
# serializing objects may lead to multi-version incompatibilities
# (https://docs.gitlab.com/ee/development/multi_version_compatibility.html)
# because there is no guarantee that the Ruby object is present in an
# older version.
#
# To safeguard against this problem, this patch checks that objects
# stored in the session are in an allow list. Note that these checks are
# restricted to test and development environments at the moment. Only
# add to the allow list if you know that the object should be handled
# gracefully in a mixed deployment.
return unless Rails.env.test? || Rails.env.development?
module Rack
module Session
module Abstract
class SessionHash
module BlockRubyObjectSerialization
ALLOWED_OBJECTS = [
Symbol, String, Integer, Float, NilClass, TrueClass, FalseClass, ActiveSupport::SafeBuffer,
# Used in app/controllers/import/bitbucket_controller.rb
ActiveSupport::Duration, ActiveSupport::TimeWithZone,
# Used in ee/app/controllers/groups/omniauth_callbacks_controller.rb
OmniAuth::AuthHash, OmniAuth::AuthHash::InfoHash, OneLogin::RubySaml::Attributes,
OneLogin::RubySaml::Response
].freeze
def []=(key, value)
unless safe_object?(value)
# rubocop:disable Gitlab/DocUrl
raise "Session attempted to store type #{value.class} with key '#{key}': #{value.inspect}.\n" \
"Serializing novel Ruby objects can cause uninitialized constants in mixed deployments.\n" \
"See https://docs.gitlab.com/ee/development/multi_version_compatibility.html"
# rubocop:enable Gitlab/DocUrl
end
super
end
private
def safe_object?(value)
return allowed_mock?(value) if Rails.env.test? && value.is_a?(RSpec::Mocks::InstanceVerifyingDouble)
case value
when Array
value.all? { |entry| safe_object?(entry) }
when Hash
safe_hash?(value)
else
ALLOWED_OBJECTS.include?(value.class)
end
end
def safe_hash?(value)
value.each do |key, val|
return false unless safe_object?(key)
return false unless safe_object?(val)
end
end
def allowed_mock?(value)
doubled_module = value.to_s
# We don't have access to the @doubled_module variable, but the output
# string will be in the form: "#[InstanceDouble(OneLogin::RubySaml::Response) (anonymous)]"
ALLOWED_OBJECTS.any? { |allowed| doubled_module.include?("InstanceDouble(#{allowed})") }
end
end
prepend BlockRubyObjectSerialization
end
end
end
end
ActionDispatch::Request::Session.prepend(Rack::Session::Abstract::SessionHash::BlockRubyObjectSerialization)
|
