Add latest changes from gitlab-org/gitlab@13-4-stable-ee

6 files changed, 467 insertions, 316 deletions

diff --git a/spec/lib/gitlab/middleware/multipart/handler_for_jwt_params_spec.rb b/spec/lib/gitlab/middleware/multipart/handler_for_jwt_params_spec.rb
new file mode 100644
index 00000000000..59ec743f6ca
--- /dev/null
+++ b/spec/lib/gitlab/middleware/multipart/handler_for_jwt_params_spec.rb
@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Middleware::Multipart::HandlerForJWTParams do
+  using RSpec::Parameterized::TableSyntax
+
+  let_it_be(:env) { Rack::MockRequest.env_for('/', method: 'post', params: {}) }
+  let_it_be(:message) { { 'rewritten_fields' => {} } }
+
+  describe '#allowed_paths' do
+    let_it_be(:expected_allowed_paths) do
+      [
+        Dir.tmpdir,
+        ::FileUploader.root,
+        ::Gitlab.config.uploads.storage_path,
+        ::JobArtifactUploader.workhorse_upload_path,
+        ::LfsObjectUploader.workhorse_upload_path,
+        File.join(Rails.root, 'public/uploads/tmp')
+      ]
+    end
+
+    let_it_be(:expected_with_packages_path) { expected_allowed_paths + [::Packages::PackageFileUploader.workhorse_upload_path] }
+
+    subject { described_class.new(env, message).send(:allowed_paths) }
+
+    where(:package_features_enabled, :object_storage_enabled, :direct_upload_enabled, :expected_paths) do
+      false | false | true  | :expected_allowed_paths
+      false | false | false | :expected_allowed_paths
+      false | true  | true  | :expected_allowed_paths
+      false | true  | false | :expected_allowed_paths
+      true  | false | true  | :expected_with_packages_path
+      true  | false | false | :expected_with_packages_path
+      true  | true  | true  | :expected_allowed_paths
+      true  | true  | false | :expected_with_packages_path
+    end
+
+    with_them do
+      before do
+        stub_config(packages: {
+          enabled: package_features_enabled,
+          object_store: {
+            enabled: object_storage_enabled,
+            direct_upload: direct_upload_enabled
+          },
+          storage_path: '/any/dir'
+        })
+      end
+
+      it { is_expected.to eq(send(expected_paths)) }
+    end
+  end
+end
diff --git a/spec/lib/gitlab/middleware/multipart/handler_spec.rb b/spec/lib/gitlab/middleware/multipart/handler_spec.rb
new file mode 100644
index 00000000000..aac3f00defe
--- /dev/null
+++ b/spec/lib/gitlab/middleware/multipart/handler_spec.rb
@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Middleware::Multipart::Handler do
+  using RSpec::Parameterized::TableSyntax
+
+  let_it_be(:env) { Rack::MockRequest.env_for('/', method: 'post', params: {}) }
+  let_it_be(:message) { { 'rewritten_fields' => {} } }
+
+  describe '#allowed_paths' do
+    let_it_be(:expected_allowed_paths) do
+      [
+        Dir.tmpdir,
+        ::FileUploader.root,
+        ::Gitlab.config.uploads.storage_path,
+        ::JobArtifactUploader.workhorse_upload_path,
+        ::LfsObjectUploader.workhorse_upload_path,
+        File.join(Rails.root, 'public/uploads/tmp')
+      ]
+    end
+
+    let_it_be(:expected_with_packages_path) { expected_allowed_paths + [::Packages::PackageFileUploader.workhorse_upload_path] }
+
+    subject { described_class.new(env, message).send(:allowed_paths) }
+
+    where(:package_features_enabled, :object_storage_enabled, :direct_upload_enabled, :expected_paths) do
+      false | false | true  | :expected_allowed_paths
+      false | false | false | :expected_allowed_paths
+      false | true  | true  | :expected_allowed_paths
+      false | true  | false | :expected_allowed_paths
+      true  | false | true  | :expected_with_packages_path
+      true  | false | false | :expected_with_packages_path
+      true  | true  | true  | :expected_allowed_paths
+      true  | true  | false | :expected_with_packages_path
+    end
+
+    with_them do
+      before do
+        stub_config(packages: {
+          enabled: package_features_enabled,
+          object_store: {
+            enabled: object_storage_enabled,
+            direct_upload: direct_upload_enabled
+          },
+          storage_path: '/any/dir'
+        })
+      end
+
+      it { is_expected.to eq(send(expected_paths)) }
+    end
+  end
+end
diff --git a/spec/lib/gitlab/middleware/multipart_spec.rb b/spec/lib/gitlab/middleware/multipart_spec.rb
deleted file mode 100644
index 3b64fe335e8..00000000000
--- a/spec/lib/gitlab/middleware/multipart_spec.rb
+++ /dev/null
@@ -1,313 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-require 'tempfile'
-
-RSpec.describe Gitlab::Middleware::Multipart do
-  include_context 'multipart middleware context'
-
-  RSpec.shared_examples_for 'multipart upload files' do
-    it 'opens top-level files' do
-      Tempfile.open('top-level') do |tempfile|
-        rewritten = { 'file' => tempfile.path }
-        in_params = { 'file.name' => original_filename, 'file.path' => file_path, 'file.remote_id' => remote_id, 'file.size' => file_size }
-        env = post_env(rewritten, in_params, Gitlab::Workhorse.secret, 'gitlab-workhorse')
-
-        expect_uploaded_file(tempfile, %w(file))
-
-        middleware.call(env)
-      end
-    end
-
-    it 'opens files one level deep' do
-      Tempfile.open('one-level') do |tempfile|
-        rewritten = { 'user[avatar]' => tempfile.path }
-        in_params = { 'user' => { 'avatar' => { '.name' => original_filename, '.path' => file_path, '.remote_id' => remote_id, '.size' => file_size } } }
-        env = post_env(rewritten, in_params, Gitlab::Workhorse.secret, 'gitlab-workhorse')
-
-        expect_uploaded_file(tempfile, %w(user avatar))
-
-        middleware.call(env)
-      end
-    end
-
-    it 'opens files two levels deep' do
-      Tempfile.open('two-levels') do |tempfile|
-        in_params = { 'project' => { 'milestone' => { 'themesong' => { '.name' => original_filename, '.path' => file_path, '.remote_id' => remote_id, '.size' => file_size } } } }
-        rewritten = { 'project[milestone][themesong]' => tempfile.path }
-        env = post_env(rewritten, in_params, Gitlab::Workhorse.secret, 'gitlab-workhorse')
-
-        expect_uploaded_file(tempfile, %w(project milestone themesong))
-
-        middleware.call(env)
-      end
-    end
-
-    def expect_uploaded_file(tempfile, path)
-      expect(app).to receive(:call) do |env|
-        file = get_params(env).dig(*path)
-        expect(file).to be_a(::UploadedFile)
-        expect(file.original_filename).to eq(original_filename)
-
-        if remote_id
-          expect(file.remote_id).to eq(remote_id)
-          expect(file.path).to be_nil
-        else
-          expect(file.path).to eq(File.realpath(tempfile.path))
-          expect(file.remote_id).to be_nil
-        end
-      end
-    end
-  end
-
-  RSpec.shared_examples_for 'handling CI artifact upload' do
-    it 'uploads both file and metadata' do
-      Tempfile.open('file') do |file|
-        Tempfile.open('metadata') do |metadata|
-          rewritten = { 'file' => file.path, 'metadata' => metadata.path }
-          in_params = { 'file.name' => 'file.txt', 'file.path' => file_path, 'file.remote_id' => file_remote_id, 'file.size' => file_size, 'metadata.name' => 'metadata.gz' }
-          env = post_env(rewritten, in_params, Gitlab::Workhorse.secret, 'gitlab-workhorse')
-
-          with_expected_uploaded_artifact_files(file, metadata) do |uploaded_file, uploaded_metadata|
-            expect(uploaded_file).to be_a(::UploadedFile)
-            expect(uploaded_file.original_filename).to eq('file.txt')
-
-            if file_remote_id
-              expect(uploaded_file.remote_id).to eq(file_remote_id)
-              expect(uploaded_file.size).to eq(file_size)
-              expect(uploaded_file.path).to be_nil
-            else
-              expect(uploaded_file.path).to eq(File.realpath(file.path))
-              expect(uploaded_file.remote_id).to be_nil
-            end
-
-            expect(uploaded_metadata).to be_a(::UploadedFile)
-            expect(uploaded_metadata.original_filename).to eq('metadata.gz')
-            expect(uploaded_metadata.path).to eq(File.realpath(metadata.path))
-            expect(uploaded_metadata.remote_id).to be_nil
-          end
-
-          middleware.call(env)
-        end
-      end
-    end
-
-    def with_expected_uploaded_artifact_files(file, metadata)
-      expect(app).to receive(:call) do |env|
-        file = get_params(env).dig('file')
-        metadata = get_params(env).dig('metadata')
-
-        yield file, metadata
-      end
-    end
-  end
-
-  it 'rejects headers signed with the wrong secret' do
-    env = post_env({ 'file' => '/var/empty/nonesuch' }, {}, 'x' * 32, 'gitlab-workhorse')
-
-    expect { middleware.call(env) }.to raise_error(JWT::VerificationError)
-  end
-
-  it 'rejects headers signed with the wrong issuer' do
-    env = post_env({ 'file' => '/var/empty/nonesuch' }, {}, Gitlab::Workhorse.secret, 'acme-inc')
-
-    expect { middleware.call(env) }.to raise_error(JWT::InvalidIssuerError)
-  end
-
-  context 'with invalid rewritten field' do
-    invalid_field_names = [
-      '[file]',
-      ';file',
-      'file]',
-      ';file]',
-      'file]]',
-      'file;;'
-    ]
-
-    invalid_field_names.each do |invalid_field_name|
-      it "rejects invalid rewritten field name #{invalid_field_name}" do
-        env = post_env({ invalid_field_name => nil }, {}, Gitlab::Workhorse.secret, 'gitlab-workhorse')
-
-        expect { middleware.call(env) }.to raise_error(RuntimeError, "invalid field: \"#{invalid_field_name}\"")
-      end
-    end
-  end
-
-  context 'with remote file' do
-    let(:remote_id) { 'someid' }
-    let(:file_size) { 300 }
-    let(:file_path) { '' }
-
-    it_behaves_like 'multipart upload files'
-  end
-
-  context 'with remote file and a file path set' do
-    let(:remote_id) { 'someid' }
-    let(:file_size) { 300 }
-    let(:file_path) { 'not_a_valid_file_path' } # file path will come from the rewritten_fields
-
-    it_behaves_like 'multipart upload files'
-  end
-
-  context 'with local file' do
-    let(:remote_id) { nil }
-    let(:file_size) { nil }
-    let(:file_path) { 'not_a_valid_file_path' } # file path will come from the rewritten_fields
-
-    it_behaves_like 'multipart upload files'
-  end
-
-  context 'with remote CI artifact upload' do
-    let(:file_remote_id) { 'someid' }
-    let(:file_size) { 300 }
-    let(:file_path) { 'not_a_valid_file_path' } # file path will come from the rewritten_fields
-
-    it_behaves_like 'handling CI artifact upload'
-  end
-
-  context 'with local CI artifact upload' do
-    let(:file_remote_id) { nil }
-    let(:file_size) { nil }
-    let(:file_path) { 'not_a_valid_file_path' } # file path will come from the rewritten_fields
-
-    it_behaves_like 'handling CI artifact upload'
-  end
-
-  it 'allows files in uploads/tmp directory' do
-    with_tmp_dir('public/uploads/tmp') do |dir, env|
-      expect(app).to receive(:call) do |env|
-        expect(get_params(env)['file']).to be_a(::UploadedFile)
-      end
-
-      middleware.call(env)
-    end
-  end
-
-  it 'allows files in the job artifact upload path' do
-    with_tmp_dir('artifacts') do |dir, env|
-      expect(JobArtifactUploader).to receive(:workhorse_upload_path).and_return(File.join(dir, 'artifacts'))
-      expect(app).to receive(:call) do |env|
-        expect(get_params(env)['file']).to be_a(::UploadedFile)
-      end
-
-      middleware.call(env)
-    end
-  end
-
-  it 'allows files in the lfs upload path' do
-    with_tmp_dir('lfs-objects') do |dir, env|
-      expect(LfsObjectUploader).to receive(:workhorse_upload_path).and_return(File.join(dir, 'lfs-objects'))
-      expect(app).to receive(:call) do |env|
-        expect(get_params(env)['file']).to be_a(::UploadedFile)
-      end
-
-      middleware.call(env)
-    end
-  end
-
-  it 'allows symlinks for uploads dir' do
-    Tempfile.open('two-levels') do |tempfile|
-      symlinked_dir = '/some/dir/uploads'
-      symlinked_path = File.join(symlinked_dir, File.basename(tempfile.path))
-      env = post_env({ 'file' => symlinked_path }, { 'file.name' => original_filename, 'file.path' => symlinked_path }, Gitlab::Workhorse.secret, 'gitlab-workhorse')
-
-      allow(FileUploader).to receive(:root).and_return(symlinked_dir)
-      allow(UploadedFile).to receive(:allowed_paths).and_return([symlinked_dir, Gitlab.config.uploads.storage_path])
-      allow(File).to receive(:realpath).and_call_original
-      allow(File).to receive(:realpath).with(symlinked_dir).and_return(Dir.tmpdir)
-      allow(File).to receive(:realpath).with(symlinked_path).and_return(tempfile.path)
-      allow(File).to receive(:exist?).and_call_original
-      allow(File).to receive(:exist?).with(symlinked_dir).and_return(true)
-
-      # override Dir.tmpdir because this dir is in the list of allowed paths
-      # and it would match FileUploader.root path (which in this test is linked
-      # to /tmp too)
-      allow(Dir).to receive(:tmpdir).and_return(File.join(Dir.tmpdir, 'tmpsubdir'))
-
-      expect(app).to receive(:call) do |env|
-        expect(get_params(env)['file']).to be_a(::UploadedFile)
-      end
-
-      middleware.call(env)
-    end
-  end
-
-  describe '#call' do
-    context 'with packages storage' do
-      using RSpec::Parameterized::TableSyntax
-
-      let(:storage_path) { 'shared/packages' }
-
-      RSpec.shared_examples 'allowing the multipart upload' do
-        it 'allows files to be uploaded' do
-          with_tmp_dir('tmp/uploads', storage_path) do |dir, env|
-            allow(Packages::PackageFileUploader).to receive(:root).and_return(File.join(dir, storage_path))
-
-            expect(app).to receive(:call) do |env|
-              expect(get_params(env)['file']).to be_a(::UploadedFile)
-            end
-
-            middleware.call(env)
-          end
-        end
-      end
-
-      RSpec.shared_examples 'not allowing the multipart upload when package upload path is used' do
-        it 'does not allow files to be uploaded' do
-          with_tmp_dir('tmp/uploads', storage_path) do |dir, env|
-            # with_tmp_dir sets the same workhorse_upload_path for all Uploaders,
-            # so we have to prevent JobArtifactUploader and LfsObjectUploader to
-            # allow the tested path
-            allow(JobArtifactUploader).to receive(:workhorse_upload_path).and_return(Dir.tmpdir)
-            allow(LfsObjectUploader).to receive(:workhorse_upload_path).and_return(Dir.tmpdir)
-
-            status, headers, body = middleware.call(env)
-
-            expect(status).to eq(400)
-            expect(headers).to eq({ 'Content-Type' => 'text/plain' })
-            expect(body).to start_with('insecure path used')
-          end
-        end
-      end
-
-      RSpec.shared_examples 'adding package storage to multipart allowed paths' do
-        before do
-          expect(::Packages::PackageFileUploader).to receive(:workhorse_upload_path).and_call_original
-        end
-
-        it_behaves_like 'allowing the multipart upload'
-      end
-
-      RSpec.shared_examples 'not adding package storage to multipart allowed paths' do
-        before do
-          expect(::Packages::PackageFileUploader).not_to receive(:workhorse_upload_path)
-        end
-
-        it_behaves_like 'not allowing the multipart upload when package upload path is used'
-      end
-
-      where(:object_storage_enabled, :direct_upload_enabled, :example_name) do
-        false | true  | 'adding package storage to multipart allowed paths'
-        false | false | 'adding package storage to multipart allowed paths'
-        true  | true  | 'not adding package storage to multipart allowed paths'
-        true  | false | 'adding package storage to multipart allowed paths'
-      end
-
-      with_them do
-        before do
-          stub_config(packages: {
-            enabled: true,
-            object_store: {
-              enabled: object_storage_enabled,
-              direct_upload: direct_upload_enabled
-            },
-            storage_path: storage_path
-          })
-        end
-
-        it_behaves_like params[:example_name]
-      end
-    end
-  end
-end
diff --git a/spec/lib/gitlab/middleware/multipart_with_handler_for_jwt_params_spec.rb b/spec/lib/gitlab/middleware/multipart_with_handler_for_jwt_params_spec.rb
new file mode 100644
index 00000000000..875e3820011
--- /dev/null
+++ b/spec/lib/gitlab/middleware/multipart_with_handler_for_jwt_params_spec.rb
@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Middleware::Multipart do
+  include MultipartHelpers
+
+  describe '#call' do
+    let(:app) { double(:app) }
+    let(:middleware) { described_class.new(app) }
+    let(:secret) { Gitlab::Workhorse.secret }
+    let(:issuer) { 'gitlab-workhorse' }
+
+    subject do
+      env = post_env(
+        rewritten_fields: rewritten_fields,
+        params: params,
+        secret: secret,
+        issuer: issuer
+      )
+      middleware.call(env)
+    end
+
+    before do
+      stub_feature_flags(upload_middleware_jwt_params_handler: true)
+    end
+
+    context 'remote file mode' do
+      let(:mode) { :remote }
+
+      it_behaves_like 'handling all upload parameters conditions'
+
+      context 'and a path set' do
+        include_context 'with one temporary file for multipart'
+
+        let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+        let(:params) { upload_parameters_for(key: 'file', filename: filename, remote_id: remote_id).merge('file.path' => '/should/not/be/read') }
+
+        it 'builds an UploadedFile' do
+          expect_uploaded_files(original_filename: filename, remote_id: remote_id, size: uploaded_file.size, params_path: %w(file))
+
+          subject
+        end
+      end
+    end
+
+    context 'local file mode' do
+      let(:mode) { :local }
+
+      it_behaves_like 'handling all upload parameters conditions'
+
+      context 'when file is' do
+        include_context 'with one temporary file for multipart'
+
+        let(:allowed_paths) { [Dir.tmpdir] }
+
+        before do
+          expect_next_instance_of(::Gitlab::Middleware::Multipart::HandlerForJWTParams) do |handler|
+            expect(handler).to receive(:allowed_paths).and_return(allowed_paths)
+          end
+        end
+
+        context 'in allowed paths' do
+          let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+          let(:params) { upload_parameters_for(filepath: uploaded_filepath, key: 'file', filename: filename) }
+
+          it 'builds an UploadedFile' do
+            expect_uploaded_files(filepath: uploaded_filepath, original_filename: filename, size: uploaded_file.size, params_path: %w(file))
+
+            subject
+          end
+        end
+
+        context 'not in allowed paths' do
+          let(:allowed_paths) { [] }
+
+          let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+          let(:params) { upload_parameters_for(filepath: uploaded_filepath, key: 'file') }
+
+          it 'returns an error' do
+            result = subject
+
+            expect(result[0]).to eq(400)
+            expect(result[2]).to include('insecure path used')
+          end
+        end
+      end
+    end
+
+    context 'with dummy params in remote mode' do
+      let(:rewritten_fields) { { 'file' => 'should/not/be/read' } }
+      let(:params) { upload_parameters_for(key: 'file') }
+      let(:mode) { :remote }
+
+      context 'with an invalid secret' do
+        let(:secret) { 'INVALID_SECRET' }
+
+        it { expect { subject }.to raise_error(JWT::VerificationError) }
+      end
+
+      context 'with an invalid issuer' do
+        let(:issuer) { 'INVALID_ISSUER' }
+
+        it { expect { subject }.to raise_error(JWT::InvalidIssuerError) }
+      end
+
+      context 'with invalid rewritten field key' do
+        invalid_keys = [
+          '[file]',
+          ';file',
+          'file]',
+          ';file]',
+          'file]]',
+          'file;;'
+        ]
+
+        invalid_keys.each do |invalid_key|
+          context invalid_key do
+            let(:rewritten_fields) { { invalid_key => 'should/not/be/read' } }
+
+            it { expect { subject }.to raise_error(RuntimeError, "invalid field: \"#{invalid_key}\"") }
+          end
+        end
+      end
+
+      context 'with invalid key in parameters' do
+        include_context 'with one temporary file for multipart'
+
+        let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+        let(:params) { upload_parameters_for(filepath: uploaded_filepath, key: 'wrong_key', filename: filename, remote_id: remote_id) }
+
+        it 'raises an error' do
+          expect { subject }.to raise_error(RuntimeError, 'Empty JWT param: file.gitlab-workhorse-upload')
+        end
+      end
+
+      context 'with a modified JWT payload' do
+        include_context 'with one temporary file for multipart'
+
+        let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+        let(:crafted_payload) { Base64.urlsafe_encode64({ 'path' => 'test' }.to_json) }
+        let(:params) do
+          upload_parameters_for(filepath: uploaded_filepath, key: 'file', filename: filename, remote_id: remote_id).tap do |params|
+            header, _, sig = params['file.gitlab-workhorse-upload'].split('.')
+            params['file.gitlab-workhorse-upload'] = [header, crafted_payload, sig].join('.')
+          end
+        end
+
+        it 'raises an error' do
+          expect { subject }.to raise_error(JWT::VerificationError, 'Signature verification raised')
+        end
+      end
+
+      context 'with a modified JWT sig' do
+        include_context 'with one temporary file for multipart'
+
+        let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+        let(:params) do
+          upload_parameters_for(filepath: uploaded_filepath, key: 'file', filename: filename, remote_id: remote_id).tap do |params|
+            header, payload, sig = params['file.gitlab-workhorse-upload'].split('.')
+            params['file.gitlab-workhorse-upload'] = [header, payload, "#{sig}modified"].join('.')
+          end
+        end
+
+        it 'raises an error' do
+          expect { subject }.to raise_error(JWT::VerificationError, 'Signature verification raised')
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/middleware/multipart_with_handler_spec.rb b/spec/lib/gitlab/middleware/multipart_with_handler_spec.rb
new file mode 100644
index 00000000000..742a5639ace
--- /dev/null
+++ b/spec/lib/gitlab/middleware/multipart_with_handler_spec.rb
@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Middleware::Multipart do
+  include MultipartHelpers
+
+  describe '#call' do
+    let(:app) { double(:app) }
+    let(:middleware) { described_class.new(app) }
+    let(:secret) { Gitlab::Workhorse.secret }
+    let(:issuer) { 'gitlab-workhorse' }
+
+    subject do
+      env = post_env(
+        rewritten_fields: rewritten_fields,
+        params: params,
+        secret: secret,
+        issuer: issuer
+      )
+      middleware.call(env)
+    end
+
+    before do
+      stub_feature_flags(upload_middleware_jwt_params_handler: false)
+    end
+
+    context 'remote file mode' do
+      let(:mode) { :remote }
+
+      it_behaves_like 'handling all upload parameters conditions'
+
+      context 'and a path set' do
+        include_context 'with one temporary file for multipart'
+
+        let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+        let(:params) { upload_parameters_for(key: 'file', filename: filename, remote_id: remote_id).merge('file.path' => '/should/not/be/read') }
+
+        it 'builds an UploadedFile' do
+          expect_uploaded_files(original_filename: filename, remote_id: remote_id, size: uploaded_file.size, params_path: %w(file))
+
+          subject
+        end
+      end
+    end
+
+    context 'local file mode' do
+      let(:mode) { :local }
+
+      it_behaves_like 'handling all upload parameters conditions'
+
+      context 'when file is' do
+        include_context 'with one temporary file for multipart'
+
+        let(:allowed_paths) { [Dir.tmpdir] }
+
+        before do
+          expect_next_instance_of(::Gitlab::Middleware::Multipart::Handler) do |handler|
+            expect(handler).to receive(:allowed_paths).and_return(allowed_paths)
+          end
+        end
+
+        context 'in allowed paths' do
+          let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+          let(:params) { upload_parameters_for(filepath: uploaded_filepath, key: 'file', filename: filename) }
+
+          it 'builds an UploadedFile' do
+            expect_uploaded_files(filepath: uploaded_filepath, original_filename: filename, size: uploaded_file.size, params_path: %w(file))
+
+            subject
+          end
+        end
+
+        context 'not in allowed paths' do
+          let(:allowed_paths) { [] }
+
+          let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+          let(:params) { upload_parameters_for(filepath: uploaded_filepath, key: 'file') }
+
+          it 'returns an error' do
+            result = subject
+
+            expect(result[0]).to eq(400)
+            expect(result[2]).to include('insecure path used')
+          end
+        end
+      end
+    end
+
+    context 'with dummy params in remote mode' do
+      let(:rewritten_fields) { { 'file' => 'should/not/be/read' } }
+      let(:params) { upload_parameters_for(key: 'file') }
+      let(:mode) { :remote }
+
+      context 'with an invalid secret' do
+        let(:secret) { 'INVALID_SECRET' }
+
+        it { expect { subject }.to raise_error(JWT::VerificationError) }
+      end
+
+      context 'with an invalid issuer' do
+        let(:issuer) { 'INVALID_ISSUER' }
+
+        it { expect { subject }.to raise_error(JWT::InvalidIssuerError) }
+      end
+
+      context 'with invalid rewritten field key' do
+        invalid_keys = [
+          '[file]',
+          ';file',
+          'file]',
+          ';file]',
+          'file]]',
+          'file;;'
+        ]
+
+        invalid_keys.each do |invalid_key|
+          context invalid_key do
+            let(:rewritten_fields) { { invalid_key => 'should/not/be/read' } }
+
+            it { expect { subject }.to raise_error(RuntimeError, "invalid field: \"#{invalid_key}\"") }
+          end
+        end
+      end
+
+      context 'with invalid key in parameters' do
+        include_context 'with one temporary file for multipart'
+
+        let(:rewritten_fields) { rewritten_fields_hash('file' => uploaded_filepath) }
+        let(:params) { upload_parameters_for(filepath: uploaded_filepath, key: 'wrong_key', filename: filename, remote_id: remote_id) }
+
+        it 'builds no UploadedFile' do
+          expect(app).to receive(:call) do |env|
+            received_params = get_params(env)
+            expect(received_params['file']).to be_nil
+            expect(received_params['wrong_key']).to be_nil
+          end
+
+          subject
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/middleware/same_site_cookies_spec.rb b/spec/lib/gitlab/middleware/same_site_cookies_spec.rb
index 7c5262ca318..2d1a9b2eee2 100644
--- a/spec/lib/gitlab/middleware/same_site_cookies_spec.rb
+++ b/spec/lib/gitlab/middleware/same_site_cookies_spec.rb
@@ -3,18 +3,24 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::Middleware::SameSiteCookies do
+  using RSpec::Parameterized::TableSyntax
   include Rack::Test::Methods
 
+  let(:user_agent) { nil }
   let(:mock_app) do
     Class.new do
-      attr_reader :cookies
+      attr_reader :cookies, :user_agent
 
       def initialize(cookies)
         @cookies = cookies
       end
 
       def call(env)
-        [200, { 'Set-Cookie' => cookies }, ['OK']]
+        [
+          200,
+          { 'Set-Cookie' => cookies },
+          ['OK']
+        ]
       end
     end
   end
@@ -29,7 +35,7 @@ RSpec.describe Gitlab::Middleware::SameSiteCookies do
     let(:request) { Rack::MockRequest.new(subject) }
 
     def do_request
-      request.post('/some/path')
+      request.post('/some/path', { 'HTTP_USER_AGENT' => user_agent }.compact )
     end
 
     context 'without SSL enabled' do
@@ -63,6 +69,43 @@ RSpec.describe Gitlab::Middleware::SameSiteCookies do
         end
       end
 
+      context 'with different browsers' do
+        where(:description, :user_agent, :expected) do
+          "iOS 12" | "Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1" | false
+          "macOS 10.14 + Safari" | "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15" | false
+          "macOS 10.14 + Opera" | "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36 OPR/47.0.2631.55" | false
+          "macOS 10.14 + Chrome v80" | "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36" | true
+          "Chrome v41" | "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36" | true
+          "Chrome v50" | "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2348.1 Safari/537.36" | true
+          "Chrome v51" | "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2718.15 Safari/537.36" | false
+          "Chrome v62" | "Mozilla/5.0 (Macintosh; Intel NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36" | false
+          "Chrome v66" | "Mozilla/5.0 (Linux; Android 4.4.2; Avvio_793 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.126 Mobile Safari/537.36" | false
+          "Chrome v67" | "Mozilla/5.0 (Linux; Android 7.1.1; SM-J510F Build/NMF26X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3371.0 Mobile Safari/537.36" | true
+          "Chrome v85" | "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36" | true
+          "Chromium v66" | "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/66.0.3359.181 HeadlessChrome/66.0.3359.181 Safari/537.36" | false
+          "Chromium v85" | "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/85.0.4183.59 Chrome/85.0.4183.59 Safari/537.36" | true
+          "UC Browser 12.0.4" | "Mozilla/5.0 (Linux; U; Android 4.4.4; zh-CN; A31 Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.0.4.986 Mobile Safari/537.36" | false
+          "UC Browser 12.13.0" | "Mozilla/5.0 (Linux; U; Android 7.1.1; en-US; SM-C9000 Build/NMF26X) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.13.0.1207 Mobile Safari/537.36" | false
+          "UC Browser 12.13.2" | "Mozilla/5.0 (Linux; U; Android 9; en-US; Redmi Note 7 Build/PQ3B.190801.002) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.13.2.1208 Mobile Safari/537.36" | true
+          "UC Browser 12.13.5" | "Mozilla/5.0 (Linux; U; Android 5.1.1; en-US; PHICOMM C630 (CLUE L) Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.13.5.1209 Mobile Safari/537.36" | true
+          "Playstation" | "Mozilla/5.0 (PlayStation 4 2.51) AppleWebKit/537.73 (KHTML, like Gecko)" | true
+        end
+
+        with_them do
+          let(:cookies) { "thiscookie=12345" }
+
+          it 'returns expected SameSite status' do
+            response = do_request
+
+            if expected
+              expect(response['Set-Cookie']).to include('SameSite=None')
+            else
+              expect(response['Set-Cookie']).not_to include('SameSite=None')
+            end
+          end
+        end
+      end
+
       context 'with single cookie' do
         let(:cookies) { "thiscookie=12345" }