Add latest changes from gitlab-org/security/gitlab@15-6-stable-ee

1 files changed, 51 insertions, 0 deletions

diff --git a/spec/models/ci/build_runner_session_spec.rb b/spec/models/ci/build_runner_session_spec.rb
index 9bb8a1bd626..8dfe854511c 100644
--- a/spec/models/ci/build_runner_session_spec.rb
+++ b/spec/models/ci/build_runner_session_spec.rb
@@ -13,6 +13,45 @@ RSpec.describe Ci::BuildRunnerSession, model: true do
   it { is_expected.to validate_presence_of(:build) }
   it { is_expected.to validate_presence_of(:url).with_message('must be a valid URL') }
 
+  context 'url validation of local web hook address' do
+    let(:url) { 'https://127.0.0.1:7777' }
+
+    subject(:build_with_local_runner_session_url) do
+      create(:ci_build).tap { |b| b.update!(runner_session_attributes: { url: url }) }
+    end
+
+    context 'with allow_local_requests_from_web_hooks_and_services? stubbed' do
+      before do
+        allow(ApplicationSetting).to receive(:current).and_return(ApplicationSetting.new)
+        stub_application_setting(allow_local_requests_from_web_hooks_and_services: allow_local_requests)
+      end
+
+      context 'as returning true' do
+        let(:allow_local_requests) { true }
+
+        it 'creates a new session', :aggregate_failures do
+          session = build_with_local_runner_session_url.reload.runner_session
+
+          expect(session.errors).to be_empty
+          expect(session).to be_a(Ci::BuildRunnerSession)
+          expect(session.url).to eq(url)
+        end
+      end
+
+      context 'as returning false' do
+        let(:allow_local_requests) { false }
+
+        it 'does not create a new session' do
+          expect { build_with_local_runner_session_url }.to raise_error(ActiveRecord::RecordInvalid) do |err|
+            expect(err.record.errors.full_messages).to include(
+              'Runner session url is blocked: Requests to localhost are not allowed'
+            )
+          end
+        end
+      end
+    end
+  end
+
   context 'nested attribute assignment' do
     it 'creates a new session' do
       simple_build = create(:ci_build)
@@ -49,6 +88,12 @@ RSpec.describe Ci::BuildRunnerSession, model: true do
       expect(specification).to be_empty
     end
 
+    it 'returns url with appended query if url has query' do
+      subject.url = 'https://new.example.com:7777/some_path?dummy='
+
+      expect(specification[:url]).to eq('wss://new.example.com:7777/some_path/exec?dummy=')
+    end
+
     context 'when url is present' do
       it 'returns ca_pem nil if empty certificate' do
         subject.certificate = ''
@@ -85,6 +130,12 @@ RSpec.describe Ci::BuildRunnerSession, model: true do
       expect(specification).to be_empty
     end
 
+    it 'returns url with appended query if url has query' do
+      subject.url = 'https://new.example.com:7777/some_path?dummy='
+
+      expect(specification[:url]).to eq("https://new.example.com:7777/some_path/proxy/#{service}/#{port}/#{path}?dummy=")
+    end
+
     context 'when port is not present' do
       let(:port) { nil }