Add latest changes from gitlab-org/gitlab@13-6-stable-eev13.6.0-rc42

6 files changed, 297 insertions, 297 deletions

diff --git a/spec/lib/gitlab/url_blockers/domain_allowlist_entry_spec.rb b/spec/lib/gitlab/url_blockers/domain_allowlist_entry_spec.rb
new file mode 100644
index 00000000000..ece0a018d53
--- /dev/null
+++ b/spec/lib/gitlab/url_blockers/domain_allowlist_entry_spec.rb
@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::UrlBlockers::DomainAllowlistEntry do
+  let(:domain) { 'www.example.com' }
+
+  describe '#initialize' do
+    it 'initializes without port' do
+      domain_allowlist_entry = described_class.new(domain)
+
+      expect(domain_allowlist_entry.domain).to eq(domain)
+      expect(domain_allowlist_entry.port).to be(nil)
+    end
+
+    it 'initializes with port' do
+      port = 8080
+      domain_allowlist_entry = described_class.new(domain, port: port)
+
+      expect(domain_allowlist_entry.domain).to eq(domain)
+      expect(domain_allowlist_entry.port).to eq(port)
+    end
+  end
+
+  describe '#match?' do
+    it 'matches when domain and port are equal' do
+      port = 8080
+      domain_allowlist_entry = described_class.new(domain, port: port)
+
+      expect(domain_allowlist_entry).to be_match(domain, port)
+    end
+
+    it 'matches any port when port is nil' do
+      domain_allowlist_entry = described_class.new(domain)
+
+      expect(domain_allowlist_entry).to be_match(domain, 8080)
+      expect(domain_allowlist_entry).to be_match(domain, 9090)
+    end
+
+    it 'does not match when port is present but requested_port is nil' do
+      domain_allowlist_entry = described_class.new(domain, port: 8080)
+
+      expect(domain_allowlist_entry).not_to be_match(domain, nil)
+    end
+
+    it 'matches when port and requested_port are nil' do
+      domain_allowlist_entry = described_class.new(domain)
+
+      expect(domain_allowlist_entry).to be_match(domain)
+    end
+
+    it 'does not match if domain is not equal' do
+      domain_allowlist_entry = described_class.new(domain)
+
+      expect(domain_allowlist_entry).not_to be_match('www.gitlab.com', 8080)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/url_blockers/domain_whitelist_entry_spec.rb b/spec/lib/gitlab/url_blockers/domain_whitelist_entry_spec.rb
deleted file mode 100644
index 58bae109146..00000000000
--- a/spec/lib/gitlab/url_blockers/domain_whitelist_entry_spec.rb
+++ /dev/null
@@ -1,58 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Gitlab::UrlBlockers::DomainWhitelistEntry do
-  let(:domain) { 'www.example.com' }
-
-  describe '#initialize' do
-    it 'initializes without port' do
-      domain_whitelist_entry = described_class.new(domain)
-
-      expect(domain_whitelist_entry.domain).to eq(domain)
-      expect(domain_whitelist_entry.port).to be(nil)
-    end
-
-    it 'initializes with port' do
-      port = 8080
-      domain_whitelist_entry = described_class.new(domain, port: port)
-
-      expect(domain_whitelist_entry.domain).to eq(domain)
-      expect(domain_whitelist_entry.port).to eq(port)
-    end
-  end
-
-  describe '#match?' do
-    it 'matches when domain and port are equal' do
-      port = 8080
-      domain_whitelist_entry = described_class.new(domain, port: port)
-
-      expect(domain_whitelist_entry).to be_match(domain, port)
-    end
-
-    it 'matches any port when port is nil' do
-      domain_whitelist_entry = described_class.new(domain)
-
-      expect(domain_whitelist_entry).to be_match(domain, 8080)
-      expect(domain_whitelist_entry).to be_match(domain, 9090)
-    end
-
-    it 'does not match when port is present but requested_port is nil' do
-      domain_whitelist_entry = described_class.new(domain, port: 8080)
-
-      expect(domain_whitelist_entry).not_to be_match(domain, nil)
-    end
-
-    it 'matches when port and requested_port are nil' do
-      domain_whitelist_entry = described_class.new(domain)
-
-      expect(domain_whitelist_entry).to be_match(domain)
-    end
-
-    it 'does not match if domain is not equal' do
-      domain_whitelist_entry = described_class.new(domain)
-
-      expect(domain_whitelist_entry).not_to be_match('www.gitlab.com', 8080)
-    end
-  end
-end
diff --git a/spec/lib/gitlab/url_blockers/ip_allowlist_entry_spec.rb b/spec/lib/gitlab/url_blockers/ip_allowlist_entry_spec.rb
new file mode 100644
index 00000000000..110a6c17adb
--- /dev/null
+++ b/spec/lib/gitlab/url_blockers/ip_allowlist_entry_spec.rb
@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::UrlBlockers::IpAllowlistEntry do
+  let(:ipv4) { IPAddr.new('192.168.1.1') }
+
+  describe '#initialize' do
+    it 'initializes without port' do
+      ip_allowlist_entry = described_class.new(ipv4)
+
+      expect(ip_allowlist_entry.ip).to eq(ipv4)
+      expect(ip_allowlist_entry.port).to be(nil)
+    end
+
+    it 'initializes with port' do
+      port = 8080
+      ip_allowlist_entry = described_class.new(ipv4, port: port)
+
+      expect(ip_allowlist_entry.ip).to eq(ipv4)
+      expect(ip_allowlist_entry.port).to eq(port)
+    end
+  end
+
+  describe '#match?' do
+    it 'matches with equivalent IP and port' do
+      port = 8080
+      ip_allowlist_entry = described_class.new(ipv4, port: port)
+
+      expect(ip_allowlist_entry).to be_match(ipv4.to_s, port)
+    end
+
+    it 'matches any port when port is nil' do
+      ip_allowlist_entry = described_class.new(ipv4)
+
+      expect(ip_allowlist_entry).to be_match(ipv4.to_s, 8080)
+      expect(ip_allowlist_entry).to be_match(ipv4.to_s, 9090)
+    end
+
+    it 'does not match when port is present but requested_port is nil' do
+      ip_allowlist_entry = described_class.new(ipv4, port: 8080)
+
+      expect(ip_allowlist_entry).not_to be_match(ipv4.to_s, nil)
+    end
+
+    it 'matches when port and requested_port are nil' do
+      ip_allowlist_entry = described_class.new(ipv4)
+
+      expect(ip_allowlist_entry).to be_match(ipv4.to_s)
+    end
+
+    it 'works with ipv6' do
+      ipv6 = IPAddr.new('fe80::c800:eff:fe74:8')
+      ip_allowlist_entry = described_class.new(ipv6)
+
+      expect(ip_allowlist_entry).to be_match(ipv6.to_s, 8080)
+    end
+
+    it 'matches ipv4 within IPv4 range' do
+      ipv4_range = IPAddr.new('127.0.0.0/28')
+      ip_allowlist_entry = described_class.new(ipv4_range)
+
+      expect(ip_allowlist_entry).to be_match(ipv4_range.to_range.last.to_s, 8080)
+      expect(ip_allowlist_entry).not_to be_match('127.0.1.1', 8080)
+    end
+
+    it 'matches IPv6 within IPv6 range' do
+      ipv6_range = IPAddr.new('fd84:6d02:f6d8:c89e::/124')
+      ip_allowlist_entry = described_class.new(ipv6_range)
+
+      expect(ip_allowlist_entry).to be_match(ipv6_range.to_range.last.to_s, 8080)
+      expect(ip_allowlist_entry).not_to be_match('fd84:6d02:f6d8:f::f', 8080)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/url_blockers/ip_whitelist_entry_spec.rb b/spec/lib/gitlab/url_blockers/ip_whitelist_entry_spec.rb
deleted file mode 100644
index 52f9b31165a..00000000000
--- a/spec/lib/gitlab/url_blockers/ip_whitelist_entry_spec.rb
+++ /dev/null
@@ -1,75 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Gitlab::UrlBlockers::IpWhitelistEntry do
-  let(:ipv4) { IPAddr.new('192.168.1.1') }
-
-  describe '#initialize' do
-    it 'initializes without port' do
-      ip_whitelist_entry = described_class.new(ipv4)
-
-      expect(ip_whitelist_entry.ip).to eq(ipv4)
-      expect(ip_whitelist_entry.port).to be(nil)
-    end
-
-    it 'initializes with port' do
-      port = 8080
-      ip_whitelist_entry = described_class.new(ipv4, port: port)
-
-      expect(ip_whitelist_entry.ip).to eq(ipv4)
-      expect(ip_whitelist_entry.port).to eq(port)
-    end
-  end
-
-  describe '#match?' do
-    it 'matches with equivalent IP and port' do
-      port = 8080
-      ip_whitelist_entry = described_class.new(ipv4, port: port)
-
-      expect(ip_whitelist_entry).to be_match(ipv4.to_s, port)
-    end
-
-    it 'matches any port when port is nil' do
-      ip_whitelist_entry = described_class.new(ipv4)
-
-      expect(ip_whitelist_entry).to be_match(ipv4.to_s, 8080)
-      expect(ip_whitelist_entry).to be_match(ipv4.to_s, 9090)
-    end
-
-    it 'does not match when port is present but requested_port is nil' do
-      ip_whitelist_entry = described_class.new(ipv4, port: 8080)
-
-      expect(ip_whitelist_entry).not_to be_match(ipv4.to_s, nil)
-    end
-
-    it 'matches when port and requested_port are nil' do
-      ip_whitelist_entry = described_class.new(ipv4)
-
-      expect(ip_whitelist_entry).to be_match(ipv4.to_s)
-    end
-
-    it 'works with ipv6' do
-      ipv6 = IPAddr.new('fe80::c800:eff:fe74:8')
-      ip_whitelist_entry = described_class.new(ipv6)
-
-      expect(ip_whitelist_entry).to be_match(ipv6.to_s, 8080)
-    end
-
-    it 'matches ipv4 within IPv4 range' do
-      ipv4_range = IPAddr.new('127.0.0.0/28')
-      ip_whitelist_entry = described_class.new(ipv4_range)
-
-      expect(ip_whitelist_entry).to be_match(ipv4_range.to_range.last.to_s, 8080)
-      expect(ip_whitelist_entry).not_to be_match('127.0.1.1', 8080)
-    end
-
-    it 'matches IPv6 within IPv6 range' do
-      ipv6_range = IPAddr.new('fd84:6d02:f6d8:c89e::/124')
-      ip_whitelist_entry = described_class.new(ipv6_range)
-
-      expect(ip_whitelist_entry).to be_match(ipv6_range.to_range.last.to_s, 8080)
-      expect(ip_whitelist_entry).not_to be_match('fd84:6d02:f6d8:f::f', 8080)
-    end
-  end
-end
diff --git a/spec/lib/gitlab/url_blockers/url_allowlist_spec.rb b/spec/lib/gitlab/url_blockers/url_allowlist_spec.rb
new file mode 100644
index 00000000000..d9e44e9b85c
--- /dev/null
+++ b/spec/lib/gitlab/url_blockers/url_allowlist_spec.rb
@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::UrlBlockers::UrlAllowlist do
+  include StubRequests
+
+  let(:allowlist) { [] }
+
+  before do
+    allow(ApplicationSetting).to receive(:current).and_return(ApplicationSetting.new)
+    stub_application_setting(outbound_local_requests_whitelist: allowlist)
+  end
+
+  describe '#domain_allowed?' do
+    let(:allowlist) { %w[www.example.com example.com] }
+
+    it 'returns true if domains present in allowlist' do
+      not_allowed = %w[subdomain.example.com example.org]
+
+      aggregate_failures do
+        allowlist.each do |domain|
+          expect(described_class).to be_domain_allowed(domain)
+        end
+
+        not_allowed.each do |domain|
+          expect(described_class).not_to be_domain_allowed(domain)
+        end
+      end
+    end
+
+    it 'returns false when domain is blank' do
+      expect(described_class).not_to be_domain_allowed(nil)
+    end
+
+    context 'with ports' do
+      let(:allowlist) { ['example.io:3000'] }
+
+      it 'returns true if domain and ports present in allowlist' do
+        parsed_allowlist = [['example.io', { port: 3000 }]]
+        not_allowed = [
+          'example.io',
+          ['example.io', { port: 3001 }]
+        ]
+
+        aggregate_failures do
+          parsed_allowlist.each do |domain_and_port|
+            expect(described_class).to be_domain_allowed(*domain_and_port)
+          end
+
+          not_allowed.each do |domain_and_port|
+            expect(described_class).not_to be_domain_allowed(*domain_and_port)
+          end
+        end
+      end
+    end
+  end
+
+  describe '#ip_allowed?' do
+    let(:allowlist) do
+      [
+        '0.0.0.0',
+        '127.0.0.1',
+        '192.168.1.1',
+        '0:0:0:0:0:ffff:192.168.1.2',
+        '::ffff:c0a8:102',
+        'fc00:bf8b:e62c:abcd:abcd:aaaa:aaaa:aaaa',
+        '0:0:0:0:0:ffff:169.254.169.254',
+        '::ffff:a9fe:a9fe',
+        '::ffff:a9fe:a864',
+        'fe80::c800:eff:fe74:8'
+      ]
+    end
+
+    it 'returns true if ips present in allowlist' do
+      aggregate_failures do
+        allowlist.each do |ip_address|
+          expect(described_class).to be_ip_allowed(ip_address)
+        end
+
+        %w[172.16.2.2 127.0.0.2 fe80::c800:eff:fe74:9].each do |ip_address|
+          expect(described_class).not_to be_ip_allowed(ip_address)
+        end
+      end
+    end
+
+    it 'returns false when ip is blank' do
+      expect(described_class).not_to be_ip_allowed(nil)
+    end
+
+    context 'with ip ranges in allowlist' do
+      let(:ipv4_range) { '127.0.0.0/28' }
+      let(:ipv6_range) { 'fd84:6d02:f6d8:c89e::/124' }
+
+      let(:allowlist) do
+        [
+          ipv4_range,
+          ipv6_range
+        ]
+      end
+
+      it 'does not allowlist ipv4 range when not in allowlist' do
+        stub_application_setting(outbound_local_requests_whitelist: [])
+
+        IPAddr.new(ipv4_range).to_range.to_a.each do |ip|
+          expect(described_class).not_to be_ip_allowed(ip.to_s)
+        end
+      end
+
+      it 'allowlists all ipv4s in the range when in allowlist' do
+        IPAddr.new(ipv4_range).to_range.to_a.each do |ip|
+          expect(described_class).to be_ip_allowed(ip.to_s)
+        end
+      end
+
+      it 'does not allowlist ipv6 range when not in allowlist' do
+        stub_application_setting(outbound_local_requests_whitelist: [])
+
+        IPAddr.new(ipv6_range).to_range.to_a.each do |ip|
+          expect(described_class).not_to be_ip_allowed(ip.to_s)
+        end
+      end
+
+      it 'allowlists all ipv6s in the range when in allowlist' do
+        IPAddr.new(ipv6_range).to_range.to_a.each do |ip|
+          expect(described_class).to be_ip_allowed(ip.to_s)
+        end
+      end
+
+      it 'does not allowlist IPs outside the range' do
+        expect(described_class).not_to be_ip_allowed("fd84:6d02:f6d8:c89e:0:0:1:f")
+
+        expect(described_class).not_to be_ip_allowed("127.0.1.15")
+      end
+    end
+
+    context 'with ports' do
+      let(:allowlist) { %w[127.0.0.9:3000 [2001:db8:85a3:8d3:1319:8a2e:370:7348]:443] }
+
+      it 'returns true if ip and ports present in allowlist' do
+        parsed_allowlist = [
+          ['127.0.0.9', { port: 3000 }],
+          ['[2001:db8:85a3:8d3:1319:8a2e:370:7348]', { port: 443 }]
+        ]
+        not_allowed = [
+          '127.0.0.9',
+          ['127.0.0.9', { port: 3001 }],
+          '[2001:db8:85a3:8d3:1319:8a2e:370:7348]',
+          ['[2001:db8:85a3:8d3:1319:8a2e:370:7348]', { port: 3001 }]
+        ]
+
+        aggregate_failures do
+          parsed_allowlist.each do |ip_and_port|
+            expect(described_class).to be_ip_allowed(*ip_and_port)
+          end
+
+          not_allowed.each do |ip_and_port|
+            expect(described_class).not_to be_ip_allowed(*ip_and_port)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/url_blockers/url_whitelist_spec.rb b/spec/lib/gitlab/url_blockers/url_whitelist_spec.rb
deleted file mode 100644
index 7a65516be3c..00000000000
--- a/spec/lib/gitlab/url_blockers/url_whitelist_spec.rb
+++ /dev/null
@@ -1,164 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Gitlab::UrlBlockers::UrlWhitelist do
-  include StubRequests
-
-  let(:whitelist) { [] }
-
-  before do
-    allow(ApplicationSetting).to receive(:current).and_return(ApplicationSetting.new)
-    stub_application_setting(outbound_local_requests_whitelist: whitelist)
-  end
-
-  describe '#domain_whitelisted?' do
-    let(:whitelist) { ['www.example.com', 'example.com'] }
-
-    it 'returns true if domains present in whitelist' do
-      not_whitelisted = ['subdomain.example.com', 'example.org']
-
-      aggregate_failures do
-        whitelist.each do |domain|
-          expect(described_class).to be_domain_whitelisted(domain)
-        end
-
-        not_whitelisted.each do |domain|
-          expect(described_class).not_to be_domain_whitelisted(domain)
-        end
-      end
-    end
-
-    it 'returns false when domain is blank' do
-      expect(described_class).not_to be_domain_whitelisted(nil)
-    end
-
-    context 'with ports' do
-      let(:whitelist) { ['example.io:3000'] }
-
-      it 'returns true if domain and ports present in whitelist' do
-        parsed_whitelist = [['example.io', { port: 3000 }]]
-        not_whitelisted = [
-          'example.io',
-          ['example.io', { port: 3001 }]
-        ]
-
-        aggregate_failures do
-          parsed_whitelist.each do |domain_and_port|
-            expect(described_class).to be_domain_whitelisted(*domain_and_port)
-          end
-
-          not_whitelisted.each do |domain_and_port|
-            expect(described_class).not_to be_domain_whitelisted(*domain_and_port)
-          end
-        end
-      end
-    end
-  end
-
-  describe '#ip_whitelisted?' do
-    let(:whitelist) do
-      [
-        '0.0.0.0',
-        '127.0.0.1',
-        '192.168.1.1',
-        '0:0:0:0:0:ffff:192.168.1.2',
-        '::ffff:c0a8:102',
-        'fc00:bf8b:e62c:abcd:abcd:aaaa:aaaa:aaaa',
-        '0:0:0:0:0:ffff:169.254.169.254',
-        '::ffff:a9fe:a9fe',
-        '::ffff:a9fe:a864',
-        'fe80::c800:eff:fe74:8'
-      ]
-    end
-
-    it 'returns true if ips present in whitelist' do
-      aggregate_failures do
-        whitelist.each do |ip_address|
-          expect(described_class).to be_ip_whitelisted(ip_address)
-        end
-
-        ['172.16.2.2', '127.0.0.2', 'fe80::c800:eff:fe74:9'].each do |ip_address|
-          expect(described_class).not_to be_ip_whitelisted(ip_address)
-        end
-      end
-    end
-
-    it 'returns false when ip is blank' do
-      expect(described_class).not_to be_ip_whitelisted(nil)
-    end
-
-    context 'with ip ranges in whitelist' do
-      let(:ipv4_range) { '127.0.0.0/28' }
-      let(:ipv6_range) { 'fd84:6d02:f6d8:c89e::/124' }
-
-      let(:whitelist) do
-        [
-          ipv4_range,
-          ipv6_range
-        ]
-      end
-
-      it 'does not whitelist ipv4 range when not in whitelist' do
-        stub_application_setting(outbound_local_requests_whitelist: [])
-
-        IPAddr.new(ipv4_range).to_range.to_a.each do |ip|
-          expect(described_class).not_to be_ip_whitelisted(ip.to_s)
-        end
-      end
-
-      it 'whitelists all ipv4s in the range when in whitelist' do
-        IPAddr.new(ipv4_range).to_range.to_a.each do |ip|
-          expect(described_class).to be_ip_whitelisted(ip.to_s)
-        end
-      end
-
-      it 'does not whitelist ipv6 range when not in whitelist' do
-        stub_application_setting(outbound_local_requests_whitelist: [])
-
-        IPAddr.new(ipv6_range).to_range.to_a.each do |ip|
-          expect(described_class).not_to be_ip_whitelisted(ip.to_s)
-        end
-      end
-
-      it 'whitelists all ipv6s in the range when in whitelist' do
-        IPAddr.new(ipv6_range).to_range.to_a.each do |ip|
-          expect(described_class).to be_ip_whitelisted(ip.to_s)
-        end
-      end
-
-      it 'does not whitelist IPs outside the range' do
-        expect(described_class).not_to be_ip_whitelisted("fd84:6d02:f6d8:c89e:0:0:1:f")
-
-        expect(described_class).not_to be_ip_whitelisted("127.0.1.15")
-      end
-    end
-
-    context 'with ports' do
-      let(:whitelist) { ['127.0.0.9:3000', '[2001:db8:85a3:8d3:1319:8a2e:370:7348]:443'] }
-
-      it 'returns true if ip and ports present in whitelist' do
-        parsed_whitelist = [
-          ['127.0.0.9', { port: 3000 }],
-          ['[2001:db8:85a3:8d3:1319:8a2e:370:7348]', { port: 443 }]
-        ]
-        not_whitelisted = [
-          '127.0.0.9',
-          ['127.0.0.9', { port: 3001 }],
-          '[2001:db8:85a3:8d3:1319:8a2e:370:7348]',
-          ['[2001:db8:85a3:8d3:1319:8a2e:370:7348]', { port: 3001 }]
-        ]
-
-        aggregate_failures do
-          parsed_whitelist.each do |ip_and_port|
-            expect(described_class).to be_ip_whitelisted(*ip_and_port)
-          end
-
-          not_whitelisted.each do |ip_and_port|
-            expect(described_class).not_to be_ip_whitelisted(*ip_and_port)
-          end
-        end
-      end
-    end
-  end
-end