Merge branch 'sh-fix-ref-matcher-regexp' into 'master'

Fix too lenient ref wildcard matcher

See merge request gitlab-org/gitaly!1158

3 files changed, 19 insertions, 2 deletions

diff --git a/changelogs/unreleased/sh-fix-ref-matcher-regexp.yml b/changelogs/unreleased/sh-fix-ref-matcher-regexp.yml
new file mode 100644
index 000000000..3d60898a9
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-ref-matcher-regexp.yml
@@ -0,0 +1,5 @@
+---
+title: Fix too lenient ref wildcard matcher
+merge_request: 1158
+author:
+type: fixed
diff --git a/ruby/lib/gitlab/ref_matcher.rb b/ruby/lib/gitlab/ref_matcher.rb
index 111bd2d50..c0bb2163a 100644
--- a/ruby/lib/gitlab/ref_matcher.rb
+++ b/ruby/lib/gitlab/ref_matcher.rb
@@ -34,7 +34,7 @@ module GitLab
       @wildcard_regex ||= begin
                             split = @ref_name_or_pattern.split('*', -1) # Use -1 to correctly handle trailing '*'
                             quoted_segments = split.map { |segment| Regexp.quote(segment) }
-                            quoted_segments.join('.*?')
+                            /\A#{quoted_segments.join('.*?')}\z/
                           end
     end
   end
diff --git a/ruby/spec/lib/gitlab/ref_matcher_spec.rb b/ruby/spec/lib/gitlab/ref_matcher_spec.rb
index 00e26328b..71d06a65d 100644
--- a/ruby/spec/lib/gitlab/ref_matcher_spec.rb
+++ b/ruby/spec/lib/gitlab/ref_matcher_spec.rb
@@ -16,7 +16,7 @@ describe GitLab::RefMatcher do
       end
     end
 
-    context "when the ref pattern  name contains wildcard(s)" do
+    context "when the ref pattern name contains wildcard(s)" do
       context "when there is a single '*'" do
         let(:pattern) { 'production/*' }
 
@@ -31,6 +31,18 @@ describe GitLab::RefMatcher do
         end
       end
 
+      context "when the wildcard begins with a '*'" do
+        let(:pattern) { '*-stable' }
+
+        it "returns true for branch names matching the wildcard" do
+          expect(subject.matches?('11-0-stable')).to be true
+        end
+
+        it "returns false for branch names not matching the wildcard" do
+          expect(subject.matches?('11-0-stable-test')).to be false
+        end
+      end
+
       context "when the wildcard contains regex symbols other than a '*'" do
         let(:pattern) { "pro.duc.tion/*" }