Username ending with MIME type format is not allowed

Re:Username ending with MIME type format is not allowed by fregante on Wednesday September 15, 2021 @02:00AM (#28535752)

My guess is that they were using /.mov$/ to check the username, which is missing an escape.

[ Parent | on HN ]

Re:Username ending with MIME type format is not allowed by ajkjk on Wednesday September 15, 2021 @02:43AM (#28535991)

Nope: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/...

just a regular .ends_with()

[ Parent | on HN ]

Re:Username ending with MIME type format is not allowed by banana_giraffe on Wednesday September 15, 2021 @12:57PM (#28541521)

So, .html is bad for a username, but .Html is ok?

What is the reason for this?

[ Parent | on HN ]

Re:Username ending with MIME type format is not allowed by marwis on Wednesday September 15, 2021 @04:16PM (#28543825)

Rails, which GitLab is based on, uses suffixes to select content renderer (such as .html, .json - apparently in case sensitive manner), also I think it will serve underlying files in some cases (e.g. the example of dashboard.html) given elsewhere.

The proper fix is to disable this mechanism at least for the username segment of gitlab path but perhaps GitLab developers are too lazy or unaware or just in rush.

[ Parent | on HN ]

Re:Username ending with MIME type format is not allowed by ajkjk on Wednesday September 15, 2021 @06:51PM (#28545437)

Probably it's a spot fix for a security problem and not what anyone thinks is ideal.

[ Parent | on HN ]