Merge branch 'fix-get-commit-signatures-for-shorthand-commit-shas' into 'master'

Validate commitIDs for get_commit_signatures

See merge request gitlab-org/gitaly!1428

3 files changed, 21 insertions, 0 deletions

diff --git a/changelogs/unreleased/fix-get-commit-signatures-for-shorthand-commit-shas.yml b/changelogs/unreleased/fix-get-commit-signatures-for-shorthand-commit-shas.yml
new file mode 100644
index 000000000..2c68c33ab
--- /dev/null
+++ b/changelogs/unreleased/fix-get-commit-signatures-for-shorthand-commit-shas.yml
@@ -0,0 +1,5 @@
+---
+title: Validate commitIDs parameter for get_commit_signatures RPC
+merge_request: 1428
+author:
+type: fixed
diff --git a/internal/service/commit/commit_signatures.go b/internal/service/commit/commit_signatures.go
index ad41fae59..2284444a6 100644
--- a/internal/service/commit/commit_signatures.go
+++ b/internal/service/commit/commit_signatures.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 
+	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/catfile"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/metadata/featureflag"
@@ -181,5 +182,12 @@ func validateGetCommitSignaturesRequest(request *gitalypb.GetCommitSignaturesReq
 		return errors.New("empty CommitIds")
 	}
 
+	// Do not support shorthand or invalid commit SHAs
+	for _, commitID := range request.CommitIds {
+		if err := git.ValidateCommitID(commitID); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
diff --git a/internal/service/commit/commit_signatures_test.go b/internal/service/commit/commit_signatures_test.go
index f99fded84..660696add 100644
--- a/internal/service/commit/commit_signatures_test.go
+++ b/internal/service/commit/commit_signatures_test.go
@@ -105,6 +105,14 @@ func TestFailedGetCommitSignaturesRequest(t *testing.T) {
 			},
 			code: codes.InvalidArgument,
 		},
+		{
+			desc: "commitIDS with shorthand sha",
+			request: &gitalypb.GetCommitSignaturesRequest{
+				Repository: testRepo,
+				CommitIds:  []string{"5937ac0a7beb003549fc5fd26fc247adbce4a52e", "a17a9f6"},
+			},
+			code: codes.InvalidArgument,
+		},
 	}
 
 	for _, testCase := range testCases {