Add latest changes from gitlab-org/security/gitlab@15-3-stable-ee

9 files changed, 39 insertions, 36 deletions

diff --git a/lib/api/commits.rb b/lib/api/commits.rb
index 7a6c3e4d53f..50d0687ba75 100644
--- a/lib/api/commits.rb
+++ b/lib/api/commits.rb
@@ -144,7 +144,7 @@ module API
             Gitlab::UsageDataCounters::EditorUniqueCounter.track_web_ide_edit_action(author: current_user, project: user_project)
           end
 
-          present commit_detail, with: Entities::CommitDetail, stats: params[:stats]
+          present commit_detail, with: Entities::CommitDetail, include_stats: params[:stats], current_user: current_user
         else
           render_api_error!(result[:message], 400)
         end
@@ -163,7 +163,7 @@ module API
 
         not_found! 'Commit' unless commit
 
-        present commit, with: Entities::CommitDetail, stats: params[:stats], current_user: current_user
+        present commit, with: Entities::CommitDetail, include_stats: params[:stats], current_user: current_user
       end
 
       desc 'Get the diff for a specific commit of a project' do
diff --git a/lib/api/entities/commit.rb b/lib/api/entities/commit.rb
index fd23c23b980..6cd180cd584 100644
--- a/lib/api/entities/commit.rb
+++ b/lib/api/entities/commit.rb
@@ -12,7 +12,9 @@ module API
       expose :trailers
 
       expose :web_url do |commit, _options|
-        Gitlab::UrlBuilder.build(commit)
+        c = commit
+        c = c.__subject__ if c.is_a?(Gitlab::View::Presenter::Base)
+        Gitlab::UrlBuilder.build(c)
       end
     end
   end
diff --git a/lib/api/entities/commit_detail.rb b/lib/api/entities/commit_detail.rb
index 61238102e9d..cc529639359 100644
--- a/lib/api/entities/commit_detail.rb
+++ b/lib/api/entities/commit_detail.rb
@@ -3,8 +3,10 @@
 module API
   module Entities
     class CommitDetail < Commit
-      expose :stats, using: Entities::CommitStats, if: :stats
-      expose :status
+      include ::API::Helpers::Presentable
+
+      expose :stats, using: Entities::CommitStats, if: :include_stats
+      expose :status_for, as: :status
       expose :project_id
 
       expose :last_pipeline do |commit, options|
diff --git a/lib/api/helpers/packages/basic_auth_helpers.rb b/lib/api/helpers/packages/basic_auth_helpers.rb
index 6c381d85cd8..ebedb3b7563 100644
--- a/lib/api/helpers/packages/basic_auth_helpers.rb
+++ b/lib/api/helpers/packages/basic_auth_helpers.rb
@@ -14,28 +14,12 @@ module API
         include Constants
         include Gitlab::Utils::StrongMemoize
 
-        def unauthorized_user_project
-          @unauthorized_user_project ||= find_project(params[:id])
-        end
-
-        def unauthorized_user_project!
-          unauthorized_user_project || not_found!
-        end
-
-        def unauthorized_user_group
-          @unauthorized_user_group ||= find_group(params[:id])
-        end
-
-        def unauthorized_user_group!
-          unauthorized_user_group || not_found!
-        end
-
         def authorized_user_project
           @authorized_user_project ||= authorized_project_find!
         end
 
         def authorized_project_find!
-          project = unauthorized_user_project
+          project = find_project(params[:id])
 
           unless project && can?(current_user, :read_project, project)
             return unauthorized_or! { not_found! }
diff --git a/lib/api/pypi_packages.rb b/lib/api/pypi_packages.rb
index ae53f08fb1d..f8a7a3c0ecc 100644
--- a/lib/api/pypi_packages.rb
+++ b/lib/api/pypi_packages.rb
@@ -84,6 +84,16 @@ module API
 
         body content
       end
+
+      def ensure_group!
+        find_group(params[:id]) || not_found!
+        find_authorized_group!
+      end
+
+      def ensure_project!
+        find_project(params[:id]) || not_found!
+        authorized_user_project
+      end
     end
 
     params do
@@ -91,7 +101,7 @@ module API
     end
     resource :groups, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
       after_validation do
-        unauthorized_user_group!
+        ensure_group!
       end
 
       namespace ':id/-/packages/pypi' do
@@ -101,7 +111,8 @@ module API
 
         route_setting :authentication, deploy_token_allowed: true, basic_auth_personal_access_token: true, job_token_allowed: :basic_auth
         get 'files/:sha256/*file_identifier' do
-          group = unauthorized_user_group!
+          group = find_authorized_group!
+          authorize_read_package!(group)
 
           filename = "#{params[:file_identifier]}.#{params[:format]}"
           package = Packages::Pypi::PackageFinder.new(current_user, group, { filename: filename, sha256: params[:sha256] }).execute
@@ -146,7 +157,7 @@ module API
 
     resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
       before do
-        unauthorized_user_project!
+        ensure_project!
       end
 
       namespace ':id/packages/pypi' do
@@ -160,7 +171,8 @@ module API
 
         route_setting :authentication, deploy_token_allowed: true, basic_auth_personal_access_token: true, job_token_allowed: :basic_auth
         get 'files/:sha256/*file_identifier' do
-          project = unauthorized_user_project!
+          project = authorized_user_project
+          authorize_read_package!(project)
 
           filename = "#{params[:file_identifier]}.#{params[:format]}"
           package = Packages::Pypi::PackageFinder.new(current_user, project, { filename: filename, sha256: params[:sha256] }).execute
diff --git a/lib/api/repositories.rb b/lib/api/repositories.rb
index cef72d898e6..c6a2d582d8a 100644
--- a/lib/api/repositories.rb
+++ b/lib/api/repositories.rb
@@ -189,7 +189,7 @@ module API
           compare = CompareService.new(user_project, params[:to]).execute(target_project, params[:from], straight: params[:straight])
 
           if compare
-            present compare, with: Entities::Compare
+            present compare, with: Entities::Compare, current_user: current_user
           else
             not_found!("Ref")
           end
diff --git a/lib/api/search.rb b/lib/api/search.rb
index c78aff705ab..7aa3cf8a5cb 100644
--- a/lib/api/search.rb
+++ b/lib/api/search.rb
@@ -123,7 +123,7 @@ module API
       get do
         verify_search_scope!(resource: nil)
 
-        present search, with: entity
+        present search, with: entity, current_user: current_user
       end
     end
 
@@ -145,7 +145,7 @@ module API
       get ':id/(-/)search' do
         verify_search_scope!(resource: user_group)
 
-        present search(group_id: user_group.id), with: entity
+        present search(group_id: user_group.id), with: entity, current_user: current_user
       end
     end
 
@@ -166,7 +166,7 @@ module API
         use :pagination
       end
       get ':id/(-/)search' do
-        present search({ project_id: user_project.id, repository_ref: params[:ref] }), with: entity
+        present search({ project_id: user_project.id, repository_ref: params[:ref] }), with: entity, current_user: current_user
       end
     end
   end
diff --git a/lib/api/submodules.rb b/lib/api/submodules.rb
index 5c71a18c6d0..2b51ab91c40 100644
--- a/lib/api/submodules.rb
+++ b/lib/api/submodules.rb
@@ -39,7 +39,7 @@ module API
 
         if result[:status] == :success
           commit_detail = user_project.repository.commit(result[:result])
-          present commit_detail, with: Entities::CommitDetail
+          present commit_detail, with: Entities::CommitDetail, current_user: current_user
         else
           render_api_error!(result[:message], result[:http_status] || 400)
         end
diff --git a/lib/banzai/filter/image_link_filter.rb b/lib/banzai/filter/image_link_filter.rb
index 60881b5f511..262c0b5340d 100644
--- a/lib/banzai/filter/image_link_filter.rb
+++ b/lib/banzai/filter/image_link_filter.rb
@@ -34,17 +34,20 @@ module Banzai
             img.remove_attribute('data-diagram-src')
           end
 
-          link.children = if link_replaces_image
-                            img['alt'] || img['data-src'] || img['src']
-                          else
-                            img.clone
-                          end
+          link.children = link_replaces_image ? link_children(img) : img.clone
 
           img.replace(link)
         end
 
         doc
       end
+
+      private
+
+      def link_children(img)
+        [img['alt'], img['data-src'], img['src']]
+          .map { |f| Sanitize.fragment(f).presence }.compact.first || ''
+      end
     end
   end
 end