GitLab: RepositoryPipeline allows importing of local git repos

Summary When importing a project via the BulkImports, the response field httpUrlToRepo from the client is used to fetch the repo: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.3.1-ee/lib/bulkimports/projects/pipelines/repositorypipeline.rbL17 ruby def loadcontext, data url = data'httpUrlToRepo'...

GitLab: Arbitrary file read via the bulk imports UploadsPipeline

Summary The bulk imports api does not remove symlinks when untaring the uploads.tar.gz file, allowing arbitrary files to be read and uploaded when importing a group. When a group has uploads such as markdown attachments, an uploads.tar.gz file will be downloaded and extracted in the...