{"action":"created","comment":{"url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/comments/42932132","id":42932132,"diff_hunk":"@@ -9,9 +9,14 @@ def commit\n     def validate\n       super\n \n-      file_name = File.basename(@file_path)\n+      if @file_path =~ Gitlab::Regex.directory_traversal_regex","path":"app/services/files/create_service.rb","position":5,"original_position":5,"commit_id":"379c76009d2a290f060b40deba9d3f4a56988b53","original_commit_id":"379c76009d2a290f060b40deba9d3f4a56988b53","user":{"login":"DouweM","id":159434,"avatar_url":"https://avatars.githubusercontent.com/u/159434?v=3","gravatar_id":"","url":"https://api.github.com/users/DouweM","html_url":"https://github.com/DouweM","followers_url":"https://api.github.com/users/DouweM/followers","following_url":"https://api.github.com/users/DouweM/following{/other_user}","gists_url":"https://api.github.com/users/DouweM/gists{/gist_id}","starred_url":"https://api.github.com/users/DouweM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DouweM/subscriptions","organizations_url":"https://api.github.com/users/DouweM/orgs","repos_url":"https://api.github.com/users/DouweM/repos","events_url":"https://api.github.com/users/DouweM/events{/privacy}","received_events_url":"https://api.github.com/users/DouweM/received_events","type":"User","site_admin":false},"body":"@stanhu I don't think we need this check if gitlab_git already does the right thing to keep us inside the repository.","created_at":"2015-10-24T09:12:48Z","updated_at":"2015-10-24T09:12:48Z","html_url":"https://github.com/gitlabhq/gitlabhq/pull/9751#discussion_r42932132","pull_request_url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751","_links":{"self":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/comments/42932132"},"html":{"href":"https://github.com/gitlabhq/gitlabhq/pull/9751#discussion_r42932132"},"pull_request":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751"}}},"pull_request":{"url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751","id":48132149,"html_url":"https://github.com/gitlabhq/gitlabhq/pull/9751","diff_url":"https://github.com/gitlabhq/gitlabhq/pull/9751.diff","patch_url":"https://github.com/gitlabhq/gitlabhq/pull/9751.patch","issue_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/9751","number":9751,"state":"open","locked":false,"title":"Add ability to create directories in the editor","user":{"login":"binford2k","id":1392917,"avatar_url":"https://avatars.githubusercontent.com/u/1392917?v=3","gravatar_id":"","url":"https://api.github.com/users/binford2k","html_url":"https://github.com/binford2k","followers_url":"https://api.github.com/users/binford2k/followers","following_url":"https://api.github.com/users/binford2k/following{/other_user}","gists_url":"https://api.github.com/users/binford2k/gists{/gist_id}","starred_url":"https://api.github.com/users/binford2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binford2k/subscriptions","organizations_url":"https://api.github.com/users/binford2k/orgs","repos_url":"https://api.github.com/users/binford2k/repos","events_url":"https://api.github.com/users/binford2k/events{/privacy}","received_events_url":"https://api.github.com/users/binford2k/received_events","type":"User","site_admin":false},"body":"Simply type a name with a `/` directory separator and new directories\r\nwill be created. This does not do the fancy UI work that github.com\r\ndoes, but it will get the job done.\r\n\r\nI could not find tests for file creation, so I didn't add a test for\r\nthis slight behaviour modification. I did test directory traversals\r\nthough, using both absolute paths like `/tmp/foo.txt` and relative paths\r\nlike `../../foo.txt`. Neither case escaped the repository, though\r\nattempting to traverse with a relative path resulted in a 500 error that\r\ndid not affect application stability upon reload.","created_at":"2015-10-19T21:58:02Z","updated_at":"2015-10-24T09:12:48Z","closed_at":null,"merged_at":null,"merge_commit_sha":"faf7e30116144f3210625f6bfe328be5ce797149","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751/commits","review_comments_url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751/comments","review_comment_url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/comments{/number}","comments_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/9751/comments","statuses_url":"https://api.github.com/repos/gitlabhq/gitlabhq/statuses/379c76009d2a290f060b40deba9d3f4a56988b53","head":{"label":"binford2k:feature/create_new_directories","ref":"feature/create_new_directories","sha":"379c76009d2a290f060b40deba9d3f4a56988b53","user":{"login":"binford2k","id":1392917,"avatar_url":"https://avatars.githubusercontent.com/u/1392917?v=3","gravatar_id":"","url":"https://api.github.com/users/binford2k","html_url":"https://github.com/binford2k","followers_url":"https://api.github.com/users/binford2k/followers","following_url":"https://api.github.com/users/binford2k/following{/other_user}","gists_url":"https://api.github.com/users/binford2k/gists{/gist_id}","starred_url":"https://api.github.com/users/binford2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binford2k/subscriptions","organizations_url":"https://api.github.com/users/binford2k/orgs","repos_url":"https://api.github.com/users/binford2k/repos","events_url":"https://api.github.com/users/binford2k/events{/privacy}","received_events_url":"https://api.github.com/users/binford2k/received_events","type":"User","site_admin":false},"repo":{"id":44564130,"name":"gitlabhq","full_name":"binford2k/gitlabhq","owner":{"login":"binford2k","id":1392917,"avatar_url":"https://avatars.githubusercontent.com/u/1392917?v=3","gravatar_id":"","url":"https://api.github.com/users/binford2k","html_url":"https://github.com/binford2k","followers_url":"https://api.github.com/users/binford2k/followers","following_url":"https://api.github.com/users/binford2k/following{/other_user}","gists_url":"https://api.github.com/users/binford2k/gists{/gist_id}","starred_url":"https://api.github.com/users/binford2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binford2k/subscriptions","organizations_url":"https://api.github.com/users/binford2k/orgs","repos_url":"https://api.github.com/users/binford2k/repos","events_url":"https://api.github.com/users/binford2k/events{/privacy}","received_events_url":"https://api.github.com/users/binford2k/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/binford2k/gitlabhq","description":"GitLab is version control for your server","fork":true,"url":"https://api.github.com/repos/binford2k/gitlabhq","forks_url":"https://api.github.com/repos/binford2k/gitlabhq/forks","keys_url":"https://api.github.com/repos/binford2k/gitlabhq/keys{/key_id}","collaborators_url":"https://api.github.com/repos/binford2k/gitlabhq/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/binford2k/gitlabhq/teams","hooks_url":"https://api.github.com/repos/binford2k/gitlabhq/hooks","issue_events_url":"https://api.github.com/repos/binford2k/gitlabhq/issues/events{/number}","events_url":"https://api.github.com/repos/binford2k/gitlabhq/events","assignees_url":"https://api.github.com/repos/binford2k/gitlabhq/assignees{/user}","branches_url":"https://api.github.com/repos/binford2k/gitlabhq/branches{/branch}","tags_url":"https://api.github.com/repos/binford2k/gitlabhq/tags","blobs_url":"https://api.github.com/repos/binford2k/gitlabhq/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/binford2k/gitlabhq/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/binford2k/gitlabhq/git/refs{/sha}","trees_url":"https://api.github.com/repos/binford2k/gitlabhq/git/trees{/sha}","statuses_url":"https://api.github.com/repos/binford2k/gitlabhq/statuses/{sha}","languages_url":"https://api.github.com/repos/binford2k/gitlabhq/languages","stargazers_url":"https://api.github.com/repos/binford2k/gitlabhq/stargazers","contributors_url":"https://api.github.com/repos/binford2k/gitlabhq/contributors","subscribers_url":"https://api.github.com/repos/binford2k/gitlabhq/subscribers","subscription_url":"https://api.github.com/repos/binford2k/gitlabhq/subscription","commits_url":"https://api.github.com/repos/binford2k/gitlabhq/commits{/sha}","git_commits_url":"https://api.github.com/repos/binford2k/gitlabhq/git/commits{/sha}","comments_url":"https://api.github.com/repos/binford2k/gitlabhq/comments{/number}","issue_comment_url":"https://api.github.com/repos/binford2k/gitlabhq/issues/comments{/number}","contents_url":"https://api.github.com/repos/binford2k/gitlabhq/contents/{+path}","compare_url":"https://api.github.com/repos/binford2k/gitlabhq/compare/{base}...{head}","merges_url":"https://api.github.com/repos/binford2k/gitlabhq/merges","archive_url":"https://api.github.com/repos/binford2k/gitlabhq/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/binford2k/gitlabhq/downloads","issues_url":"https://api.github.com/repos/binford2k/gitlabhq/issues{/number}","pulls_url":"https://api.github.com/repos/binford2k/gitlabhq/pulls{/number}","milestones_url":"https://api.github.com/repos/binford2k/gitlabhq/milestones{/number}","notifications_url":"https://api.github.com/repos/binford2k/gitlabhq/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/binford2k/gitlabhq/labels{/name}","releases_url":"https://api.github.com/repos/binford2k/gitlabhq/releases{/id}","created_at":"2015-10-19T21:07:07Z","updated_at":"2015-10-19T21:07:19Z","pushed_at":"2015-10-21T20:03:01Z","git_url":"git://github.com/binford2k/gitlabhq.git","ssh_url":"git@github.com:binford2k/gitlabhq.git","clone_url":"https://github.com/binford2k/gitlabhq.git","svn_url":"https://github.com/binford2k/gitlabhq","homepage":"https://gitlab.com/gitlab-org/gitlab-ce/tree/master","size":103650,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"gitlabhq:master","ref":"master","sha":"d25b50fda63e830cb2c87281bba064b71185e712","user":{"login":"gitlabhq","id":1086321,"avatar_url":"https://avatars.githubusercontent.com/u/1086321?v=3","gravatar_id":"","url":"https://api.github.com/users/gitlabhq","html_url":"https://github.com/gitlabhq","followers_url":"https://api.github.com/users/gitlabhq/followers","following_url":"https://api.github.com/users/gitlabhq/following{/other_user}","gists_url":"https://api.github.com/users/gitlabhq/gists{/gist_id}","starred_url":"https://api.github.com/users/gitlabhq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gitlabhq/subscriptions","organizations_url":"https://api.github.com/users/gitlabhq/orgs","repos_url":"https://api.github.com/users/gitlabhq/repos","events_url":"https://api.github.com/users/gitlabhq/events{/privacy}","received_events_url":"https://api.github.com/users/gitlabhq/received_events","type":"Organization","site_admin":false},"repo":{"id":2500088,"name":"gitlabhq","full_name":"gitlabhq/gitlabhq","owner":{"login":"gitlabhq","id":1086321,"avatar_url":"https://avatars.githubusercontent.com/u/1086321?v=3","gravatar_id":"","url":"https://api.github.com/users/gitlabhq","html_url":"https://github.com/gitlabhq","followers_url":"https://api.github.com/users/gitlabhq/followers","following_url":"https://api.github.com/users/gitlabhq/following{/other_user}","gists_url":"https://api.github.com/users/gitlabhq/gists{/gist_id}","starred_url":"https://api.github.com/users/gitlabhq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gitlabhq/subscriptions","organizations_url":"https://api.github.com/users/gitlabhq/orgs","repos_url":"https://api.github.com/users/gitlabhq/repos","events_url":"https://api.github.com/users/gitlabhq/events{/privacy}","received_events_url":"https://api.github.com/users/gitlabhq/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/gitlabhq/gitlabhq","description":"GitLab is version control for your server","fork":false,"url":"https://api.github.com/repos/gitlabhq/gitlabhq","forks_url":"https://api.github.com/repos/gitlabhq/gitlabhq/forks","keys_url":"https://api.github.com/repos/gitlabhq/gitlabhq/keys{/key_id}","collaborators_url":"https://api.github.com/repos/gitlabhq/gitlabhq/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/gitlabhq/gitlabhq/teams","hooks_url":"https://api.github.com/repos/gitlabhq/gitlabhq/hooks","issue_events_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/events{/number}","events_url":"https://api.github.com/repos/gitlabhq/gitlabhq/events","assignees_url":"https://api.github.com/repos/gitlabhq/gitlabhq/assignees{/user}","branches_url":"https://api.github.com/repos/gitlabhq/gitlabhq/branches{/branch}","tags_url":"https://api.github.com/repos/gitlabhq/gitlabhq/tags","blobs_url":"https://api.github.com/repos/gitlabhq/gitlabhq/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/gitlabhq/gitlabhq/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/gitlabhq/gitlabhq/git/refs{/sha}","trees_url":"https://api.github.com/repos/gitlabhq/gitlabhq/git/trees{/sha}","statuses_url":"https://api.github.com/repos/gitlabhq/gitlabhq/statuses/{sha}","languages_url":"https://api.github.com/repos/gitlabhq/gitlabhq/languages","stargazers_url":"https://api.github.com/repos/gitlabhq/gitlabhq/stargazers","contributors_url":"https://api.github.com/repos/gitlabhq/gitlabhq/contributors","subscribers_url":"https://api.github.com/repos/gitlabhq/gitlabhq/subscribers","subscription_url":"https://api.github.com/repos/gitlabhq/gitlabhq/subscription","commits_url":"https://api.github.com/repos/gitlabhq/gitlabhq/commits{/sha}","git_commits_url":"https://api.github.com/repos/gitlabhq/gitlabhq/git/commits{/sha}","comments_url":"https://api.github.com/repos/gitlabhq/gitlabhq/comments{/number}","issue_comment_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/comments{/number}","contents_url":"https://api.github.com/repos/gitlabhq/gitlabhq/contents/{+path}","compare_url":"https://api.github.com/repos/gitlabhq/gitlabhq/compare/{base}...{head}","merges_url":"https://api.github.com/repos/gitlabhq/gitlabhq/merges","archive_url":"https://api.github.com/repos/gitlabhq/gitlabhq/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/gitlabhq/gitlabhq/downloads","issues_url":"https://api.github.com/repos/gitlabhq/gitlabhq/issues{/number}","pulls_url":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls{/number}","milestones_url":"https://api.github.com/repos/gitlabhq/gitlabhq/milestones{/number}","notifications_url":"https://api.github.com/repos/gitlabhq/gitlabhq/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/gitlabhq/gitlabhq/labels{/name}","releases_url":"https://api.github.com/repos/gitlabhq/gitlabhq/releases{/id}","created_at":"2011-10-02T16:25:27Z","updated_at":"2015-10-24T07:43:27Z","pushed_at":"2015-10-24T06:12:04Z","git_url":"git://github.com/gitlabhq/gitlabhq.git","ssh_url":"git@github.com:gitlabhq/gitlabhq.git","clone_url":"https://github.com/gitlabhq/gitlabhq.git","svn_url":"https://github.com/gitlabhq/gitlabhq","homepage":"https://gitlab.com/gitlab-org/gitlab-ce/tree/master","size":182136,"stargazers_count":16562,"watchers_count":16562,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":4462,"mirror_url":null,"open_issues_count":567,"forks":4462,"open_issues":567,"watchers":16562,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751"},"html":{"href":"https://github.com/gitlabhq/gitlabhq/pull/9751"},"issue":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/9751"},"comments":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/issues/9751/comments"},"review_comments":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751/comments"},"review_comment":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/pulls/9751/commits"},"statuses":{"href":"https://api.github.com/repos/gitlabhq/gitlabhq/statuses/379c76009d2a290f060b40deba9d3f4a56988b53"}}}}