Add latest changes from gitlab-org/gitlab@16-2-stable-eev16.2.0-rc42

4 files changed, 140 insertions, 2 deletions

diff --git a/spec/lib/gitlab/email/handler/service_desk_handler_spec.rb b/spec/lib/gitlab/email/handler/service_desk_handler_spec.rb
index ef2acc9ec92..98522c53a47 100644
--- a/spec/lib/gitlab/email/handler/service_desk_handler_spec.rb
+++ b/spec/lib/gitlab/email/handler/service_desk_handler_spec.rb
@@ -381,6 +381,125 @@ RSpec.describe Gitlab::Email::Handler::ServiceDeskHandler, feature_category: :se
           it_behaves_like 'a new issue request'
         end
       end
+
+      context 'when receiving a service desk custom email address verification email' do
+        let(:email_raw) { service_desk_fixture('emails/service_desk_custom_email_address_verification.eml') }
+
+        shared_examples 'an early exiting handler' do
+          it 'does not trigger the verification process and does not add an issue' do
+            expect(ServiceDesk::CustomEmailVerifications::UpdateService).to receive(:execute).exactly(0).times
+            expect { receiver.execute }.to not_change { Issue.count }
+          end
+        end
+
+        shared_examples 'a handler that does not verify the custom email' do |error_identifier|
+          it 'does not verify the custom email address' do
+            # project has no owner, so only notify verification triggerer
+            expect(Notify).to receive(:service_desk_verification_result_email).once
+
+            receiver.execute
+
+            expect(settings.reload.custom_email_enabled).to be false
+            expect(verification.reload).to have_attributes(
+              state: 'failed',
+              error: error_identifier
+            )
+          end
+        end
+
+        shared_examples 'a handler that verifies Service Desk custom email verification emails' do
+          it_behaves_like 'an early exiting handler'
+
+          context 'with valid service desk settings' do
+            let_it_be(:user) { create(:user) }
+
+            let!(:settings) { create(:service_desk_setting, project: project, custom_email: 'custom-support-email@example.com') }
+            let!(:verification) { create(:service_desk_custom_email_verification, project: project, token: 'ZROT4ZZXA-Y6', triggerer: user) }
+
+            let(:message_delivery) { instance_double(ActionMailer::MessageDelivery) }
+
+            before do
+              project.add_maintainer(user)
+
+              allow(message_delivery).to receive(:deliver_later)
+              allow(Notify).to receive(:service_desk_verification_result_email).and_return(message_delivery)
+            end
+
+            it 'successfully verifies the custom email address' do
+              # project has no owner, so only notify verification triggerer
+              expect(Notify).to receive(:service_desk_verification_result_email).once
+
+              receiver.execute
+
+              expect(settings.reload.custom_email_enabled).to be false
+              expect(verification.reload).to have_attributes(
+                state: 'finished',
+                error: nil
+              )
+            end
+
+            context 'and custom email address is not the configured subaddress of the project' do
+              before do
+                settings.update!(custom_email: 'custom-support-email@example.com')
+              end
+
+              it_behaves_like 'an early exiting handler'
+            end
+
+            context 'and verification tokens do not match' do
+              before do
+                verification.update!(token: 'XXXXXXXXXXXX')
+              end
+
+              it_behaves_like 'a handler that does not verify the custom email', 'incorrect_token'
+            end
+
+            context 'and verification email ingested too late' do
+              before do
+                verification.update!(triggered_at: ServiceDesk::CustomEmailVerification::TIMEFRAME.ago)
+              end
+
+              it_behaves_like 'a handler that does not verify the custom email', 'mail_not_received_within_timeframe'
+            end
+
+            context 'and from header differs from custom email address' do
+              before do
+                settings.update!(custom_email: 'different-from@example.com')
+              end
+
+              it_behaves_like 'a handler that does not verify the custom email', 'incorrect_from'
+            end
+          end
+
+          context 'when service_desk_custom_email feature flag is disabled' do
+            before do
+              stub_feature_flags(service_desk_custom_email: false)
+            end
+
+            it 'does not trigger the verification process and adds an issue instead' do
+              expect { receiver.execute }.to change { Issue.count }.by(1)
+            end
+          end
+        end
+
+        context 'when using incoming_email address' do
+          before do
+            stub_incoming_email_setting(enabled: true, address: 'support+%{key}@example.com')
+          end
+
+          it_behaves_like 'a handler that verifies Service Desk custom email verification emails'
+        end
+
+        context 'when using service_desk_email address' do
+          let(:receiver) { Gitlab::Email::ServiceDeskReceiver.new(email_raw) }
+
+          before do
+            stub_service_desk_email_setting(enabled: true, address: 'support+%{key}@example.com')
+          end
+
+          it_behaves_like 'a handler that verifies Service Desk custom email verification emails'
+        end
+      end
     end
 
     context 'when issue email creation fails' do
diff --git a/spec/lib/gitlab/email/handler_spec.rb b/spec/lib/gitlab/email/handler_spec.rb
index d38b7d9c85c..d3a4d77c58e 100644
--- a/spec/lib/gitlab/email/handler_spec.rb
+++ b/spec/lib/gitlab/email/handler_spec.rb
@@ -75,7 +75,7 @@ RSpec.describe Gitlab::Email::Handler do
         described_class.for(email, address).class
       end
 
-      expect(matched_handlers.uniq).to match_array(Gitlab::Email::Handler.handlers)
+      expect(matched_handlers.uniq).to match_array(described_class.handlers)
     end
 
     it 'can pick exactly one handler for each address' do
diff --git a/spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb b/spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb
index 7dd4ee7e25d..2632be98026 100644
--- a/spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb
+++ b/spec/lib/gitlab/email/hook/smime_signature_interceptor_spec.rb
@@ -36,7 +36,7 @@ RSpec.describe Gitlab::Email::Hook::SmimeSignatureInterceptor do
   end
 
   before do
-    allow(Gitlab::Email::Hook::SmimeSignatureInterceptor).to receive(:certificate).and_return(certificate)
+    allow(described_class).to receive(:certificate).and_return(certificate)
 
     Mail.register_interceptor(described_class)
     mail.deliver_now
diff --git a/spec/lib/gitlab/email/receiver_spec.rb b/spec/lib/gitlab/email/receiver_spec.rb
index e58da2478bf..ee836fc2129 100644
--- a/spec/lib/gitlab/email/receiver_spec.rb
+++ b/spec/lib/gitlab/email/receiver_spec.rb
@@ -226,6 +226,25 @@ RSpec.describe Gitlab::Email::Receiver do
     end
   end
 
+  context "when the received field is malformed" do
+    let(:email_raw) do
+      attack = "for <<" * 100_000
+      [
+        "Delivered-To: incoming+gitlabhq/gitlabhq+auth_token@appmail.example.com",
+        "Received: from mail.example.com #{attack}; Thu, 13 Jun 2013 17:03:50 -0400",
+        "To: \"support@example.com\" <support@example.com>",
+        "",
+        "Email content"
+      ].join("\n")
+    end
+
+    it 'mail_metadata has no ReDos issue' do
+      Timeout.timeout(2) do
+        Gitlab::Email::Receiver.new(email_raw).mail_metadata
+      end
+    end
+  end
+
   it 'requires all handlers to have a unique metric_event' do
     events = Gitlab::Email::Handler.handlers.map do |handler|
       handler.new(Mail::Message.new, 'gitlabhq/gitlabhq+auth_token').metrics_event