diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-10-20 12:40:42 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-10-20 12:40:42 +0300 |
commit | ee664acb356f8123f4f6b00b73c1e1cf0866c7fb (patch) | |
tree | f8479f94a28f66654c6a4f6fb99bad6b4e86a40e /spec/requests/git_http_spec.rb | |
parent | 62f7d5c5b69180e82ae8196b7b429eeffc8e7b4f (diff) |
Add latest changes from gitlab-org/gitlab@15-5-stable-eev15.5.0-rc42
Diffstat (limited to 'spec/requests/git_http_spec.rb')
-rw-r--r-- | spec/requests/git_http_spec.rb | 54 |
1 files changed, 16 insertions, 38 deletions
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb index 81e923983ab..20d298edfe5 100644 --- a/spec/requests/git_http_spec.rb +++ b/spec/requests/git_http_spec.rb @@ -880,29 +880,20 @@ RSpec.describe 'Git HTTP requests' do let(:path) { "#{project.full_path}.git" } let(:env) { { user: 'gitlab-ci-token', password: build.token } } - it_behaves_like 'pulls are allowed' + it 'rejects pulls' do + download(path, **env) do |response| + expect(response).to have_gitlab_http_status(:not_found) + end + end - # A non-401 here is not an information leak since the system is - # "authenticated" as CI using the correct token. It does not have - # push access, so pushes should be rejected as forbidden, and giving - # a reason is fine. - # - # We know for sure it is not an information leak since pulls using - # the build token must be allowed. - it "rejects pushes with 403 Forbidden" do + it 'rejects pushes' do push_get(path, **env) expect(response).to have_gitlab_http_status(:forbidden) - expect(response.body).to eq(git_access_error(:auth_upload)) end - # We are "authenticated" as CI using a valid token here. But we are - # not authorized to see any other project, so return "not found". - it "rejects pulls for other project with 404 Not Found" do - clone_get("#{other_project.full_path}.git", **env) - - expect(response).to have_gitlab_http_status(:not_found) - expect(response.body).to eq(git_access_error(:project_not_found)) + def pull + download(path, **env) end end @@ -1494,33 +1485,21 @@ RSpec.describe 'Git HTTP requests' do added_by: user) end + # legacy behavior that is blocked/deprecated context 'when build created by system is authenticated' do let(:path) { "#{project.full_path}.git" } let(:env) { { user: 'gitlab-ci-token', password: build.token } } - it_behaves_like 'pulls are allowed' + it 'rejects pulls' do + download(path, **env) do |response| + expect(response).to have_gitlab_http_status(:not_found) + end + end - # A non-401 here is not an information leak since the system is - # "authenticated" as CI using the correct token. It does not have - # push access, so pushes should be rejected as forbidden, and giving - # a reason is fine. - # - # We know for sure it is not an information leak since pulls using - # the build token must be allowed. - it "rejects pushes with 403 Forbidden" do + it 'rejects pushes' do push_get(path, **env) expect(response).to have_gitlab_http_status(:forbidden) - expect(response.body).to eq(git_access_error(:auth_upload)) - end - - # We are "authenticated" as CI using a valid token here. But we are - # not authorized to see any other project, so return "not found". - it "rejects pulls for other project with 404 Not Found" do - clone_get("#{other_project.full_path}.git", **env) - - expect(response).to have_gitlab_http_status(:not_found) - expect(response.body).to eq(git_access_error(:project_not_found)) end end @@ -1780,8 +1759,7 @@ RSpec.describe 'Git HTTP requests' do end describe "User with LDAP identity" do - let(:user) { create(:omniauth_user, extern_uid: dn) } - let(:dn) { 'uid=john,ou=people,dc=example,dc=com' } + let(:user) { create(:omniauth_user, :ldap) } let(:path) { 'doesnt/exist.git' } before do |