Merge remote-tracking branch 'dev/14-6-stable' into 14-6-stable

9 files changed, 62 insertions, 20 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 019d01958..93c88672b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Gitaly changelog
 
+## 14.6.2 (2022-01-10)
+
+### Fixed (1 change)
+
+- [Optimize link repository ID migration](gitlab-org/security/gitaly@ab7d1b8dcaf9708a310ca941b60d0e39ff61649d)
+
 ## 14.6.1 (2022-01-04)
 
 No changes.
diff --git a/VERSION b/VERSION
index 9b87fcc4a..bf8aaa2ef 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-14.6.1
\ No newline at end of file
+14.6.2
\ No newline at end of file
diff --git a/internal/git/catfile/object_reader_test.go b/internal/git/catfile/object_reader_test.go
index 78738f988..7bec07470 100644
--- a/internal/git/catfile/object_reader_test.go
+++ b/internal/git/catfile/object_reader_test.go
@@ -419,3 +419,31 @@ func TestObjectReader_queue(t *testing.T) {
 		require.Equal(t, os.ErrClosed, err)
 	})
 }
+
+func TestObjectReader_replaceRefs(t *testing.T) {
+	cfg, repoProto, repoPath := testcfg.BuildWithRepo(t)
+
+	ctx, cancel := testhelper.Context()
+	defer cancel()
+
+	originalOID := gittest.WriteBlob(t, cfg, repoPath, []byte("original"))
+	replacedOID := gittest.WriteBlob(t, cfg, repoPath, []byte("replaced"))
+
+	gittest.WriteRef(t, cfg, repoPath, git.ReferenceName("refs/replace/"+originalOID.String()), replacedOID)
+
+	// Reading the object via our testhelper should result in the object having been replaced.
+	require.Equal(t, "replaced", text.ChompBytes(gittest.Exec(t, cfg, "-C", repoPath, "cat-file", "-p", originalOID.String())))
+
+	reader, err := newObjectReader(ctx, newRepoExecutor(t, cfg, repoProto), nil)
+	require.NoError(t, err)
+
+	object, err := reader.Object(ctx, originalOID.Revision())
+	require.NoError(t, err)
+
+	contents, err := io.ReadAll(object)
+	require.NoError(t, err)
+
+	// But using our "normal" Git command execution code path, we still want to see the original
+	// content of the blob.
+	require.Equal(t, "original", string(contents))
+}
diff --git a/internal/git/command_factory.go b/internal/git/command_factory.go
index c3be0eb60..2a6325e6a 100644
--- a/internal/git/command_factory.go
+++ b/internal/git/command_factory.go
@@ -30,6 +30,13 @@ var globalOptions = []GlobalOption{
 	// done when reading blobs from the object database. This is
 	// required for the web editor.
 	ConfigPair{Key: "core.autocrlf", Value: "input"},
+
+	// Git allows the use of replace refs, where a given object ID can be replaced with a
+	// different one. The result is that Git commands would use the new object instead of the
+	// old one in almost all contexts. This is a security threat: an adversary may use this
+	// mechanism to replace malicious commits with seemingly benign ones. We thus globally
+	// disable this mechanism.
+	ConfigPair{Key: "core.useReplaceRefs", Value: "false"},
 }
 
 // CommandFactory is designed to create and run git commands in a protected and fully managed manner.
diff --git a/internal/git/gittest/branch.go b/internal/git/gittest/branch.go
deleted file mode 100644
index 7d2cfae64..000000000
--- a/internal/git/gittest/branch.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package gittest
-
-import (
-	"testing"
-
-	"gitlab.com/gitlab-org/gitaly/v14/internal/gitaly/config"
-)
-
-// CreateRemoteBranch creates a new remote branch
-func CreateRemoteBranch(t testing.TB, cfg config.Cfg, repoPath, remoteName, branchName, ref string) {
-	Exec(t, cfg, "-C", repoPath, "update-ref", "refs/remotes/"+remoteName+"/"+branchName, ref)
-}
diff --git a/internal/git/gittest/ref.go b/internal/git/gittest/ref.go
new file mode 100644
index 000000000..19e9c2cbe
--- /dev/null
+++ b/internal/git/gittest/ref.go
@@ -0,0 +1,13 @@
+package gittest
+
+import (
+	"testing"
+
+	"gitlab.com/gitlab-org/gitaly/v14/internal/git"
+	"gitlab.com/gitlab-org/gitaly/v14/internal/gitaly/config"
+)
+
+// WriteRef writes a reference into the repository pointing to the given object ID.
+func WriteRef(t testing.TB, cfg config.Cfg, repoPath string, ref git.ReferenceName, oid git.ObjectID) {
+	Exec(t, cfg, "-C", repoPath, "update-ref", ref.String(), oid.String())
+}
diff --git a/internal/gitaly/service/ref/refs_test.go b/internal/gitaly/service/ref/refs_test.go
index aa427e097..58407d2d7 100644
--- a/internal/gitaly/service/ref/refs_test.go
+++ b/internal/gitaly/service/ref/refs_test.go
@@ -664,8 +664,7 @@ func TestSuccessfulFindAllBranchesRequest(t *testing.T) {
 		},
 	}
 
-	gittest.CreateRemoteBranch(t, cfg, repoPath, "origin",
-		"fake-remote-branch", remoteBranch.Target.Id)
+	gittest.WriteRef(t, cfg, repoPath, "refs/remotes/origin/fake-remote-branch", git.ObjectID(remoteBranch.Target.Id))
 
 	request := &gitalypb.FindAllBranchesRequest{Repository: repo}
 	ctx, cancel := testhelper.Context()
diff --git a/internal/gitaly/service/ref/remote_branches_test.go b/internal/gitaly/service/ref/remote_branches_test.go
index 7712148e7..b5ab276ce 100644
--- a/internal/gitaly/service/ref/remote_branches_test.go
+++ b/internal/gitaly/service/ref/remote_branches_test.go
@@ -1,6 +1,7 @@
 package ref
 
 import (
+	"fmt"
 	"io"
 	"testing"
 
@@ -22,21 +23,21 @@ func TestSuccessfulFindAllRemoteBranchesRequest(t *testing.T) {
 	repo := localrepo.NewTestRepo(t, cfg, repoProto)
 
 	remoteName := "my-remote"
-	expectedBranches := map[string]string{
+	expectedBranches := map[string]git.ObjectID{
 		"foo": "c7fbe50c7c7419d9701eebe64b1fdacc3df5b9dd",
 		"bar": "60ecb67744cb56576c30214ff52294f8ce2def98",
 	}
 	excludedRemote := "my-remote-2"
-	excludedBranches := map[string]string{
+	excludedBranches := map[string]git.ObjectID{
 		"from-another-remote": "5937ac0a7beb003549fc5fd26fc247adbce4a52e",
 	}
 
 	for branchName, commitID := range expectedBranches {
-		gittest.CreateRemoteBranch(t, cfg, repoPath, remoteName, branchName, commitID)
+		gittest.WriteRef(t, cfg, repoPath, git.ReferenceName(fmt.Sprintf("refs/remotes/%s/%s", remoteName, branchName)), commitID)
 	}
 
 	for branchName, commitID := range excludedBranches {
-		gittest.CreateRemoteBranch(t, cfg, repoPath, excludedRemote, branchName, commitID)
+		gittest.WriteRef(t, cfg, repoPath, git.ReferenceName(fmt.Sprintf("refs/remotes/%s/%s", excludedRemote, branchName)), commitID)
 	}
 
 	request := &gitalypb.FindAllRemoteBranchesRequest{Repository: repoProto, RemoteName: remoteName}
diff --git a/ruby/proto/gitaly/version.rb b/ruby/proto/gitaly/version.rb
index bbff07096..cca26ed02 100644
--- a/ruby/proto/gitaly/version.rb
+++ b/ruby/proto/gitaly/version.rb
@@ -2,5 +2,5 @@
 # (https://gitlab.com/gitlab-org/release-tools/), and should not be
 # modified.
 module Gitaly
-  VERSION = '14.6.1'
+  VERSION = '14.6.2'
 end