GitLab

3 reasons GitLab isn't vulnerable to Gollum + 1 tip

Dec 9, 2014Job van der Voort
3 reasons GitLab isn't vulnerable to Gollum + 1 tip
SummaryAI, from the source post

This post details how GitLab avoids a specific Remote Code Execution (RCE) vulnerability in the Gollum wiki by not using Gollum's search functionality, by using `Shellwords.shellescape(query)` for search queries, and by switching to the Rugged library instead of Grit. It also recommends adopting secure coding guidelines for Ruby developers to prevent similar vulnerabilities.

More from the Git Core Improvements and Contributions trail