
12/9/2014 · Job van der Voort
What this post added
This post addresses a specific vulnerability in Gollum, a git-powered wiki, and explains why GitLab is not affected. The reasons cited are: 1. GitLab uses its own search implementation, not Gollum's. 2. GitLab employs `Shellwords.shellescape(query)` for search queries. 3. Since GitLab 7.4, the company has transitioned to using the `rugged` library, completely avoiding the `grit` library. It also notes that GitLab installations prior to version 6.6 are also not vulnerable. The post also highlights that the `gitlab-grit` gem, developed by GitLab, was the source of the vulnerability and recommends adopting GitLab's guidelines for combating remote code execution vulnerabilities, further emphasizing the move to `Rugged`.