[fregante]

My guess is that they were using /.mov$/ to check the username, which is missing an escape.

[ajkjk]

Nope: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954/...

just a regular .ends_with()

[banana_giraffe]

So, .html is bad for a username, but .Html is ok?

What is the reason for this?

[marwis]

Rails, which GitLab is based on, uses suffixes to select content renderer (such as .html, .json - apparently in case sensitive manner), also I think it will serve underlying files in some cases (e.g. the example of dashboard.html) given elsewhere.

The proper fix is to disable this mechanism at least for the username segment of gitlab path but perhaps GitLab developers are too lazy or unaware or just in rush.

[ajkjk]

Probably it's a spot fix for a security problem and not what anyone thinks is ideal.