diff options
author | Alessio Caiazza <acaiazza@gitlab.com> | 2019-02-08 19:11:37 +0300 |
---|---|---|
committer | Alessio Caiazza <acaiazza@gitlab.com> | 2019-02-08 19:39:15 +0300 |
commit | d5c858cd4032b3bf37c6fbe47340ccea825503bc (patch) | |
tree | 49df95b6ebb13ddf923007cbc47dd1e6253af11d /spec/requests/api | |
parent | a6794a2736e9df488d4d8b5b336fded0b58d7d26 (diff) |
Prevent Releases links API to leak tag existance
Diffstat (limited to 'spec/requests/api')
-rw-r--r-- | spec/requests/api/release/links_spec.rb | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/spec/requests/api/release/links_spec.rb b/spec/requests/api/release/links_spec.rb index ba948e37e2f..3a59052bb29 100644 --- a/spec/requests/api/release/links_spec.rb +++ b/spec/requests/api/release/links_spec.rb @@ -73,6 +73,22 @@ describe API::Release::Links do expect(response).to have_gitlab_http_status(:ok) end end + + context 'when project is public and the repository is private' do + let(:project) { create(:project, :repository, :public, :repository_private) } + + it_behaves_like '403 response' do + let(:request) { get api("/projects/#{project.id}/releases/v0.1/assets/links", non_project_member) } + end + + context 'when the release does not exists' do + let!(:release) { } + + it_behaves_like '403 response' do + let(:request) { get api("/projects/#{project.id}/releases/v0.1/assets/links", non_project_member) } + end + end + end end end |