Commit 149b0979 authored by GitLab Release Tools Bot's avatar GitLab Release Tools Bot
Browse files

Merge remote-tracking branch 'dev/13-10-stable' into 13-10-stable

......@@ -2,6 +2,28 @@
documentation](doc/development/changelog.md) for instructions on adding your own
entry.
## 13.10.1 (2021-03-31)
### Security (6 changes)
- Leave pool repository on fork unlinking.
- Fixed XSS in merge requests sidebar.
- Fix arbitrary read/write in AsciiDoctor and Kroki gems.
- Prevent infinite loop when checking if collaboration is allowed.
- Disable arbitrary URI and file reads in JSON validator.
- Require POST request to trigger system hooks.
### Removed (1 change)
- Make HipChat project service do nothing. !57434
### Other (3 changes)
- Remove direct mimemagic dependency. !57387
- Refactor MimeMagic calls to new MimeType class. !57421
- Switch to using a fake mimemagic gem. !57443
## 13.10.0 (2021-03-22)
### Security (3 changes)
......
13.10.0
\ No newline at end of file
13.10.1
\ No newline at end of file
13.10.0
\ No newline at end of file
13.10.1
\ No newline at end of file
......@@ -1337,8 +1337,8 @@ def broken?
has_no_commits? || branch_missing? || cannot_be_merged?
end
def can_be_merged_by?(user)
access = ::Gitlab::UserAccess.new(user, container: project)
def can_be_merged_by?(user, skip_collaboration_check: false)
access = ::Gitlab::UserAccess.new(user, container: project, skip_collaboration_check: skip_collaboration_check)
access.can_update_branch?(target_branch)
end
......
......@@ -2704,7 +2704,7 @@ def fetch_branch_allows_collaboration(user, branch_name = nil)
# Issue for N+1: https://gitlab.com/gitlab-org/gitlab-foss/issues/49322
Gitlab::GitalyClient.allow_n_plus_1_calls do
merge_requests_allowing_collaboration(branch_name).any? do |merge_request|
merge_request.can_be_merged_by?(user)
merge_request.can_be_merged_by?(user, skip_collaboration_check: true)
end
end
end
......
......@@ -32,6 +32,8 @@ def execute
if fork_network = @project.root_of_fork_network
fork_network.update(root_project: nil, deleted_root_project_name: @project.full_name)
end
@project.leave_pool_repository
end
# rubocop: disable Cop/InBatches
......
......@@ -138,7 +138,7 @@
= clipboard_button(text: source_branch, title: _('Copy branch name'), placement: "left", boundary: 'viewport')
.sidebar-mr-source-branch.hide-collapsed
%span
= _('Source branch: %{source_branch_open}%{source_branch}%{source_branch_close}').html_safe % { source_branch_open: "<cite class='ref-name' title='#{source_branch}'>".html_safe, source_branch_close: "</cite>".html_safe, source_branch: source_branch }
= _('Source branch: %{source_branch_open}%{source_branch}%{source_branch_close}').html_safe % { source_branch_open: "<cite class='ref-name' title='#{html_escape(source_branch)}'>".html_safe, source_branch_close: "</cite>".html_safe, source_branch: html_escape(source_branch) }
= clipboard_button(text: source_branch, title: _('Copy branch name'), placement: "left", boundary: 'viewport')
- if show_forwarding_email
......
---
title: Switch to using a fake mimemagic gem
merge_request: 57443
author:
type: other
---
title: Refactor MimeMagic calls to new MimeType class
merge_request: 57421
author:
type: other
---
title: Remove direct mimemagic dependency
merge_request: 57387
author:
type: other
---
title: Make HipChat project service do nothing
merge_request: 57434
author:
type: removed
# frozen_string_literal: true
# Ensure that locked attributes can not be changed using a counter.
# TODO: this can be removed once `asciidoctor` gem is > 2.0.12
# and https://github.com/asciidoctor/asciidoctor/issues/3939 is merged
module Asciidoctor
module DocumentPatch
def counter(name, seed = nil)
return @parent_document.counter(name, seed) if @parent_document # rubocop: disable Gitlab/ModuleWithInstanceVariables
unless attribute_locked? name
super
end
end
end
end
class Asciidoctor::Document
prepend Asciidoctor::DocumentPatch
end
# frozen_string_literal: true
# This patches https://github.com/ruby-json-schema/json-schema/blob/765e6d8fdbfdaca1a42fa743f4621e757f9f6a03/lib/json-schema/validator.rb
# to address https://github.com/ruby-json-schema/json-schema/issues/148.
require 'json-schema'
module JSON
class Validator
def initialize_data(data)
if @options[:parse_data]
if @options[:json]
data = self.class.parse(data)
elsif @options[:uri]
json_uri = Util::URI.normalized_uri(data)
data = self.class.parse(custom_open(json_uri))
elsif data.is_a?(String)
begin
data = self.class.parse(data)
rescue JSON::Schema::JsonParseError
# Silently discard the error - use the data as-is
end
end
end
JSON::Schema.stringify(data)
end
end
end
......@@ -88,7 +88,7 @@ Example response:
## Test system hook
```plaintext
GET /hooks/:id
POST /hooks/:id
```
| Attribute | Type | Required | Description |
......@@ -98,7 +98,7 @@ GET /hooks/:id
Example request:
```shell
curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/hooks/2"
curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/hooks/1"
```
Example response:
......
......@@ -47,7 +47,7 @@ class SystemHooks < ::API::Base
params do
requires :id, type: Integer, desc: 'The ID of the system hook'
end
get ":id" do
post ":id" do
hook = SystemHook.find(params[:id])
data = {
event_name: "project_create",
......
......@@ -3,7 +3,7 @@
module Gitlab
module MarkdownCache
# Increment this number every time the renderer changes its output
CACHE_COMMONMARK_VERSION = 26
CACHE_COMMONMARK_VERSION = 27
CACHE_COMMONMARK_VERSION_START = 10
BaseError = Class.new(StandardError)
......
......@@ -11,10 +11,11 @@ class UserAccess
attr_reader :user, :push_ability
attr_accessor :container
def initialize(user, container: nil, push_ability: :push_code)
def initialize(user, container: nil, push_ability: :push_code, skip_collaboration_check: false)
@user = user
@container = container
@push_ability = push_ability
@skip_collaboration_check = skip_collaboration_check
end
def can_do_action?(action)
......@@ -87,6 +88,8 @@ def can_push_for_ref?(_)
private
attr_reader :skip_collaboration_check
def can_push?
user.can?(push_ability, container)
end
......@@ -98,6 +101,8 @@ def can_collaborate?(ref)
end
def branch_allows_collaboration_for?(ref)
return false if skip_collaboration_check
# Checking for an internal project or group to prevent an infinite loop:
# https://gitlab.com/gitlab-org/gitlab/issues/36805
(!project.internal? && project.branch_allows_collaboration?(user, ref))
......
......@@ -6,7 +6,7 @@
state { :none }
before(:create) do |pool|
pool.source_project = create(:project, :repository)
pool.source_project ||= create(:project, :repository)
pool.source_project.update!(pool_repository: pool)
end
......
......@@ -111,4 +111,21 @@
end
end
end
context 'XSS source branch' do
let(:project) { create(:project, :public, :repository) }
let(:source_branch) { "&#39;&gt;&lt;iframe/srcdoc=&#39;&#39;&gt;&lt;/iframe&gt;" }
before do
project.repository.create_branch(source_branch, "master")
mr = create(:merge_request, source_project: project, target_project: project, source_branch: source_branch)
visit(merge_request_path(mr))
end
it 'encodes branch name' do
expect(find('cite.ref-name')[:title]).to eq(source_branch)
end
end
end
# frozen_string_literal: true
require 'spec_helper'
require 'rspec-parameterized'
RSpec.describe 'JSON validator patch' do
using RSpec::Parameterized::TableSyntax
let(:schema) { '{"format": "string"}' }
subject { JSON::Validator.validate(schema, data) }
context 'with invalid JSON' do
where(:data) do
[
'https://example.com',
'/tmp/test.txt'
]
end
with_them do
it 'does not attempt to open a file or URI' do
allow(File).to receive(:read).and_call_original
allow(URI).to receive(:open).and_call_original
expect(File).not_to receive(:read).with(data)
expect(URI).not_to receive(:open).with(data)
expect(subject).to be true
end
end
end
context 'with valid JSON' do
let(:data) { %({ 'somekey': 'value' }) }
it 'validates successfully' do
expect(subject).to be true
end
end
end
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment