Add latest changes from gitlab-org/security/gitlab@15-1-stable-ee

3 files changed, 166 insertions, 77 deletions

diff --git a/spec/graphql/resolvers/ci/config_resolver_spec.rb b/spec/graphql/resolvers/ci/config_resolver_spec.rb
index 7a6104fc503..dc030b1313b 100644
--- a/spec/graphql/resolvers/ci/config_resolver_spec.rb
+++ b/spec/graphql/resolvers/ci/config_resolver_spec.rb
@@ -7,24 +7,13 @@ RSpec.describe Resolvers::Ci::ConfigResolver do
 
   describe '#resolve' do
     let_it_be(:user) { create(:user) }
-    let_it_be(:project) { create(:project, :repository, creator: user, namespace: user.namespace) }
+    let_it_be(:project) { create(:project, :repository) }
     let_it_be(:sha) { nil }
 
     let_it_be(:content) do
       File.read(Rails.root.join('spec/support/gitlab_stubs/gitlab_ci_includes.yml'))
     end
 
-    let(:ci_lint) do
-      ci_lint_double = instance_double(::Gitlab::Ci::Lint)
-      allow(ci_lint_double).to receive(:validate).and_return(fake_result)
-
-      ci_lint_double
-    end
-
-    before do
-      allow(::Gitlab::Ci::Lint).to receive(:new).and_return(ci_lint)
-    end
-
     subject(:response) do
       resolve(described_class,
               args: { project_path: project.full_path, content: content, sha: sha },
@@ -51,52 +40,77 @@ RSpec.describe Resolvers::Ci::ConfigResolver do
       end
     end
 
-    context 'with a valid .gitlab-ci.yml' do
-      context 'with a sha' do
-        let(:sha) { '1231231' }
+    context 'when the user can create a pipeline' do
+      let(:ci_lint) do
+        ci_lint_double = instance_double(::Gitlab::Ci::Lint)
+        allow(ci_lint_double).to receive(:validate).and_return(fake_result)
 
-        it_behaves_like 'a valid config file'
+        ci_lint_double
       end
 
-      context 'without a sha' do
-        it_behaves_like 'a valid config file'
+      before do
+        allow(::Gitlab::Ci::Lint).to receive(:new).and_return(ci_lint)
+
+        project.add_developer(user)
       end
-    end
 
-    context 'with an invalid .gitlab-ci.yml' do
-      let(:content) { 'invalid' }
+      context 'with a valid .gitlab-ci.yml' do
+        context 'with a sha' do
+          let(:sha) { '1231231' }
 
-      let(:fake_result) do
-        Gitlab::Ci::Lint::Result.new(
-          jobs: [],
-          merged_yaml: content,
-          errors: ['Invalid configuration format'],
-          warnings: [],
-          includes: []
-        )
+          it_behaves_like 'a valid config file'
+        end
+
+        context 'without a sha' do
+          it_behaves_like 'a valid config file'
+        end
       end
 
-      it 'responds with errors about invalid syntax' do
-        expect(response[:status]).to eq(:invalid)
-        expect(response[:errors]).to eq(['Invalid configuration format'])
+      context 'with an invalid .gitlab-ci.yml' do
+        let(:content) { 'invalid' }
+
+        let(:fake_result) do
+          Gitlab::Ci::Lint::Result.new(
+            jobs: [],
+            merged_yaml: content,
+            errors: ['Invalid configuration format'],
+            warnings: [],
+            includes: []
+          )
+        end
+
+        it 'responds with errors about invalid syntax' do
+          expect(response[:status]).to eq(:invalid)
+          expect(response[:errors]).to match_array(['Invalid configuration format'])
+        end
       end
-    end
 
-    context 'with an invalid SHA' do
-      let_it_be(:sha) { ':' }
+      context 'with an invalid SHA' do
+        let_it_be(:sha) { ':' }
 
-      let(:ci_lint) do
-        ci_lint_double = instance_double(::Gitlab::Ci::Lint)
-        allow(ci_lint_double).to receive(:validate).and_raise(GRPC::InvalidArgument)
+        let(:ci_lint) do
+          ci_lint_double = instance_double(::Gitlab::Ci::Lint)
+          allow(ci_lint_double).to receive(:validate).and_raise(GRPC::InvalidArgument)
 
-        ci_lint_double
+          ci_lint_double
+        end
+
+        it 'logs the invalid SHA to Sentry' do
+          expect(Gitlab::ErrorTracking).to receive(:track_and_raise_exception)
+            .with(GRPC::InvalidArgument, sha: ':')
+
+          response
+        end
       end
+    end
 
-      it 'logs the invalid SHA to Sentry' do
-        expect(Gitlab::ErrorTracking).to receive(:track_and_raise_exception)
-          .with(GRPC::InvalidArgument, sha: ':')
+    context 'when the user cannot create a pipeline' do
+      before do
+        project.add_guest(user)
+      end
 
-        response
+      it 'returns an error stating that the user cannot access the linting' do
+        expect(response).to be_instance_of(::Gitlab::Graphql::Errors::ResourceNotAvailable)
       end
     end
   end
diff --git a/spec/initializers/net_http_response_patch_spec.rb b/spec/initializers/net_http_response_patch_spec.rb
new file mode 100644
index 00000000000..3bd0d8c3907
--- /dev/null
+++ b/spec/initializers/net_http_response_patch_spec.rb
@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Net::HTTPResponse patch header read timeout' do
+  describe '.each_response_header' do
+    let(:server_response) do
+      <<~EOS
+        Content-Type: text/html
+        Header-Two: foo
+
+        Hello World
+      EOS
+    end
+
+    before do
+      stub_const('Gitlab::BufferedIo::HEADER_READ_TIMEOUT', 0.1)
+    end
+
+    subject(:each_response_header) { Net::HTTPResponse.each_response_header(socket) { |k, v| } }
+
+    context 'with Net::BufferedIO' do
+      let(:socket) { Net::BufferedIO.new(StringIO.new(server_response)) }
+
+      it 'does not forward start time to the socket' do
+        allow(socket).to receive(:readuntil).and_call_original
+        expect(socket).to receive(:readuntil).with("\n", true)
+
+        each_response_header
+      end
+
+      context 'when the response contains many consecutive spaces' do
+        before do
+          expect(socket).to receive(:readuntil).and_return(
+            "a: #{' ' * 100_000} b",
+            ''
+          )
+        end
+
+        it 'has no regex backtracking issues' do
+          Timeout.timeout(1) do
+            each_response_header
+          end
+        end
+      end
+    end
+
+    context 'with Gitlab::BufferedIo' do
+      let(:mock_io) { StringIO.new(server_response) }
+      let(:socket) { Gitlab::BufferedIo.new(mock_io) }
+
+      it 'forwards start time to the socket' do
+        allow(socket).to receive(:readuntil).and_call_original
+        expect(socket).to receive(:readuntil).with("\n", true, kind_of(Numeric))
+
+        each_response_header
+      end
+
+      context 'when the response contains an infinite number of headers' do
+        before do
+          read_counter = 0
+
+          allow(mock_io).to receive(:read_nonblock) do
+            read_counter += 1
+            raise 'Test did not raise HeaderReadTimeout' if read_counter > 10
+
+            sleep 0.01
+            +"Yet-Another-Header: foo\n"
+          end
+        end
+
+        it 'raises a timeout error' do
+          expect { each_response_header }.to raise_error(Gitlab::HTTP::HeaderReadTimeout,
+            /Request timed out after reading headers for 0\.[0-9]+ seconds/)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/buffered_io_spec.rb b/spec/lib/gitlab/buffered_io_spec.rb
index f8896abd46e..c6939b819e2 100644
--- a/spec/lib/gitlab/buffered_io_spec.rb
+++ b/spec/lib/gitlab/buffered_io_spec.rb
@@ -1,54 +1,50 @@
-# rubocop:disable Style/FrozenStringLiteralComment
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 RSpec.describe Gitlab::BufferedIo do
   describe '#readuntil' do
-    let(:never_ending_tcp_socket) do
-      Class.new do
-        def initialize(*_)
-          @read_counter = 0
-        end
+    let(:mock_io) { StringIO.new('a') }
+    let(:start_time) { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
 
-        def setsockopt(*_); end
+    before do
+      stub_const('Gitlab::BufferedIo::HEADER_READ_TIMEOUT', 0.1)
+    end
 
-        def closed?
-          false
-        end
+    subject(:readuntil) do
+      Gitlab::BufferedIo.new(mock_io).readuntil('a', false, start_time)
+    end
 
-        def close
-          true
-        end
+    it 'does not raise a timeout error' do
+      expect { readuntil }.not_to raise_error
+    end
 
-        def to_io
-          StringIO.new('Hello World!')
-        end
+    context 'when the response contains infinitely long headers' do
+      before do
+        read_counter = 0
 
-        def write_nonblock(data, *_)
-          data.size
-        end
+        allow(mock_io).to receive(:read_nonblock) do |buffer_size, *_|
+          read_counter += 1
+          raise 'Test did not raise HeaderReadTimeout' if read_counter > 10
 
-        def read_nonblock(buffer_size, *_)
           sleep 0.01
-          @read_counter += 1
-
-          raise 'Test did not raise HeaderReadTimeout' if @read_counter > 10
-
           'H' * buffer_size
         end
       end
-    end
 
-    before do
-      stub_const('Gitlab::BufferedIo::HEADER_READ_TIMEOUT', 0.1)
-    end
+      it 'raises a timeout error' do
+        expect { readuntil }.to raise_error(Gitlab::HTTP::HeaderReadTimeout, /Request timed out after reading headers for 0\.[0-9]+ seconds/)
+      end
 
-    subject(:readuntil) do
-      Gitlab::BufferedIo.new(never_ending_tcp_socket.new).readuntil('a')
-    end
+      context 'when not passing start_time' do
+        subject(:readuntil) do
+          Gitlab::BufferedIo.new(mock_io).readuntil('a', false)
+        end
 
-    it 'raises a timeout error' do
-      expect { readuntil }.to raise_error(Gitlab::HTTP::HeaderReadTimeout, /Request timed out after reading headers for 0\.[0-9]+ seconds/)
+        it 'raises a timeout error' do
+          expect { readuntil }.to raise_error(Gitlab::HTTP::HeaderReadTimeout, /Request timed out after reading headers for 0\.[0-9]+ seconds/)
+        end
+      end
     end
   end
 end
-# rubocop:enable Style/FrozenStringLiteralComment