• Kassio Borges's avatar
    Deny localhost requests on fogbugz importer · d04dc6d2
    Kassio Borges authored
    Fogbugz importer controller is not validating the URI param received to
    do the import. This is a blind SSRF security fail. To fix it a
    validation on the URI param was added not allowing the import to perform
    when receiving localhost URIs.
    d04dc6d2
fogbugz_controller.rb 3.43 KB