5 ms·

My guess is that they were using /.mov$/ to check the username, which is missing an escape.

• ajkjk 5y ago
  Nope: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/diffs?commit_id=0b4e1788d14edaf16e3ce999fd0520b3d2467e01 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/... just a regular .ends_with()
  • banana_giraffe 5y ago
    So, .html is bad for a username, but .Html is ok? What is the reason for this?
    • marwis 5y ago
      Rails, which GitLab is based on, uses suffixes to select content renderer (such as .html, .json - apparently in case sensitive manner), also I think it will serve underlying files in some cases (e.g. the example of dashboard.html) given elsewhere. The proper fix is to disable this mechanism at least for the username segment of gitlab path but perhaps GitLab developers are too lazy or unaware or just in rush.
      • ajkjk 5y ago
        Probably it's a spot fix for a security problem and not what anyone thinks is ideal.