diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2019-12-31 12:55:45 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2019-12-31 12:55:45 +0300 |
commit | 8a97772aca25cb233778ce99c487c674c86ba2fd (patch) | |
tree | 4bbb2614385ca3cf88c166a5faaf0679cf97f7db /spec | |
parent | 5bc8aa03f1ac7ff5a20ae77e8f62631370a52d1a (diff) |
Add latest changes from gitlab-org/security/gitlab@12-6-stable-ee
Diffstat (limited to 'spec')
-rw-r--r-- | spec/controllers/profiles/notifications_controller_spec.rb | 29 | ||||
-rw-r--r-- | spec/controllers/projects/releases_controller_spec.rb | 81 | ||||
-rw-r--r-- | spec/controllers/sent_notifications_controller_spec.rb | 35 | ||||
-rw-r--r-- | spec/fixtures/api/schemas/evidences/milestone.json | 9 | ||||
-rw-r--r-- | spec/lib/banzai/filter/relative_link_filter_spec.rb | 9 | ||||
-rw-r--r-- | spec/requests/api/graphql/gitlab_schema_spec.rb | 12 | ||||
-rw-r--r-- | spec/requests/api/releases_spec.rb | 34 |
7 files changed, 192 insertions, 17 deletions
diff --git a/spec/controllers/profiles/notifications_controller_spec.rb b/spec/controllers/profiles/notifications_controller_spec.rb index dbc408bcdd9..ede68744ac6 100644 --- a/spec/controllers/profiles/notifications_controller_spec.rb +++ b/spec/controllers/profiles/notifications_controller_spec.rb @@ -52,6 +52,35 @@ describe Profiles::NotificationsController do end.to exceed_query_limit(control) end end + + context 'with project notifications' do + let!(:notification_setting) { create(:notification_setting, source: project, user: user, level: :watch) } + + before do + sign_in(user) + get :show + end + + context 'when project is public' do + let(:project) { create(:project, :public) } + + it 'shows notification setting for project' do + expect(assigns(:project_notifications).map(&:source_id)).to include(project.id) + end + end + + context 'when project is public' do + let(:project) { create(:project, :private) } + + it 'shows notification setting for project' do + # notification settings for given project were created before project was set to private + expect(user.notification_settings.for_projects.map(&:source_id)).to include(project.id) + + # check that notification settings for project where user does not have access are filtered + expect(assigns(:project_notifications)).to be_empty + end + end + end end describe 'POST update' do diff --git a/spec/controllers/projects/releases_controller_spec.rb b/spec/controllers/projects/releases_controller_spec.rb index e9fa3764117..750e9aabef0 100644 --- a/spec/controllers/projects/releases_controller_spec.rb +++ b/spec/controllers/projects/releases_controller_spec.rb @@ -167,7 +167,7 @@ describe Projects::ReleasesController do end describe 'GET #evidence' do - let(:tag_name) { "v1.1.0-evidence" } + let_it_be(:tag_name) { "v1.1.0-evidence" } let!(:release) { create(:release, :with_evidence, project: project, tag: tag_name) } let(:tag) { CGI.escape(release.tag) } let(:format) { :json } @@ -220,6 +220,85 @@ describe Projects::ReleasesController do it_behaves_like 'successful request' end end + + context 'when release is associated to a milestone which includes an issue' do + let_it_be(:project) { create(:project, :repository, :public) } + let_it_be(:issue) { create(:issue, project: project) } + let_it_be(:milestone) { create(:milestone, project: project, issues: [issue]) } + let_it_be(:release) { create(:release, project: project, tag: tag_name, milestones: [milestone]) } + + before do + create(:evidence, release: release) + end + + shared_examples_for 'does not show the issue in evidence' do + it do + subject + + expect(response).to have_gitlab_http_status(:ok) + expect(json_response['release']['milestones'] + .all? { |milestone| milestone['issues'].nil? }).to eq(true) + end + end + + shared_examples_for 'evidence not found' do + it do + subject + + expect(response).to have_gitlab_http_status(:not_found) + end + end + + shared_examples_for 'safely expose evidence' do + it_behaves_like 'does not show the issue in evidence' + + context 'when the issue is confidential' do + let(:issue) { create(:issue, :confidential, project: project) } + + it_behaves_like 'does not show the issue in evidence' + end + + context 'when the user is the author of the confidential issue' do + let(:issue) { create(:issue, :confidential, project: project, author: user) } + + it_behaves_like 'does not show the issue in evidence' + end + + context 'when project is private' do + let!(:project) { create(:project, :repository, :private) } + + it_behaves_like 'evidence not found' + end + + context 'when project restricts the visibility of issues to project members only' do + let!(:project) { create(:project, :repository, :issues_private) } + + it_behaves_like 'evidence not found' + end + end + + context 'when user is non-project member' do + let(:user) { create(:user) } + + it_behaves_like 'safely expose evidence' + end + + context 'when user is auditor', if: Gitlab.ee? do + let(:user) { create(:user, :auditor) } + + it_behaves_like 'safely expose evidence' + end + + context 'when external authorization control is enabled' do + let(:user) { create(:user) } + + before do + stub_application_setting(external_authorization_service_enabled: true) + end + + it_behaves_like 'evidence not found' + end + end end private diff --git a/spec/controllers/sent_notifications_controller_spec.rb b/spec/controllers/sent_notifications_controller_spec.rb index 0e634d8ba99..4dd4f49dcf1 100644 --- a/spec/controllers/sent_notifications_controller_spec.rb +++ b/spec/controllers/sent_notifications_controller_spec.rb @@ -56,7 +56,7 @@ describe SentNotificationsController do get(:unsubscribe, params: { id: sent_notification.reply_key }) end - shared_examples 'unsubscribing as anonymous' do + shared_examples 'unsubscribing as anonymous' do |project_visibility| it 'does not unsubscribe the user' do expect(noteable.subscribed?(user, target_project)).to be_truthy end @@ -69,6 +69,18 @@ describe SentNotificationsController do expect(response.status).to eq(200) expect(response).to render_template :unsubscribe end + + if project_visibility == :private + it 'does not show project name or path' do + expect(response.body).not_to include(noteable.project.name) + expect(response.body).not_to include(noteable.project.full_name) + end + else + it 'shows project name or path' do + expect(response.body).to include(noteable.project.name) + expect(response.body).to include(noteable.project.full_name) + end + end end context 'when project is public' do @@ -79,7 +91,7 @@ describe SentNotificationsController do expect(response.body).to include(issue.title) end - it_behaves_like 'unsubscribing as anonymous' + it_behaves_like 'unsubscribing as anonymous', :public end context 'when unsubscribing from confidential issue' do @@ -90,7 +102,7 @@ describe SentNotificationsController do expect(response.body).to include(confidential_issue.to_reference) end - it_behaves_like 'unsubscribing as anonymous' + it_behaves_like 'unsubscribing as anonymous', :public end context 'when unsubscribing from merge request' do @@ -100,7 +112,12 @@ describe SentNotificationsController do expect(response.body).to include(merge_request.title) end - it_behaves_like 'unsubscribing as anonymous' + it 'shows project name or path' do + expect(response.body).to include(issue.project.name) + expect(response.body).to include(issue.project.full_name) + end + + it_behaves_like 'unsubscribing as anonymous', :public end end @@ -110,11 +127,11 @@ describe SentNotificationsController do context 'when unsubscribing from issue' do let(:noteable) { issue } - it 'shows issue title' do + it 'does not show issue title' do expect(response.body).not_to include(issue.title) end - it_behaves_like 'unsubscribing as anonymous' + it_behaves_like 'unsubscribing as anonymous', :private end context 'when unsubscribing from confidential issue' do @@ -125,17 +142,17 @@ describe SentNotificationsController do expect(response.body).to include(confidential_issue.to_reference) end - it_behaves_like 'unsubscribing as anonymous' + it_behaves_like 'unsubscribing as anonymous', :private end context 'when unsubscribing from merge request' do let(:noteable) { merge_request } - it 'shows merge request title' do + it 'dos not show merge request title' do expect(response.body).not_to include(merge_request.title) end - it_behaves_like 'unsubscribing as anonymous' + it_behaves_like 'unsubscribing as anonymous', :private end end end diff --git a/spec/fixtures/api/schemas/evidences/milestone.json b/spec/fixtures/api/schemas/evidences/milestone.json index ab27fdecde2..3ce0644225b 100644 --- a/spec/fixtures/api/schemas/evidences/milestone.json +++ b/spec/fixtures/api/schemas/evidences/milestone.json @@ -7,8 +7,7 @@ "state", "iid", "created_at", - "due_date", - "issues" + "due_date" ], "properties": { "id": { "type": "integer" }, @@ -17,11 +16,7 @@ "state": { "type": "string" }, "iid": { "type": "integer" }, "created_at": { "type": "date" }, - "due_date": { "type": ["date", "null"] }, - "issues": { - "type": "array", - "items": { "$ref": "issue.json" } - } + "due_date": { "type": ["date", "null"] } }, "additionalProperties": false } diff --git a/spec/lib/banzai/filter/relative_link_filter_spec.rb b/spec/lib/banzai/filter/relative_link_filter_spec.rb index a17a645d4d0..9f467d7a6fd 100644 --- a/spec/lib/banzai/filter/relative_link_filter_spec.rb +++ b/spec/lib/banzai/filter/relative_link_filter_spec.rb @@ -128,6 +128,15 @@ describe Banzai::Filter::RelativeLinkFilter do expect { filter(act) }.not_to raise_error end + it 'does not raise an exception on URIs containing invalid utf-8 byte sequences in uploads' do + act = link("/uploads/%FF") + expect { filter(act) }.not_to raise_error + end + + it 'does not raise an exception on URIs containing invalid utf-8 byte sequences in context requested path' do + expect { filter(link("files/test.md"), requested_path: '%FF') }.not_to raise_error + end + it 'does not raise an exception with a garbled path' do act = link("open(/var/tmp/):%20/location%0Afrom:%20/test") expect { filter(act) }.not_to raise_error diff --git a/spec/requests/api/graphql/gitlab_schema_spec.rb b/spec/requests/api/graphql/gitlab_schema_spec.rb index 2aeb75a10b4..2cb8436662b 100644 --- a/spec/requests/api/graphql/gitlab_schema_spec.rb +++ b/spec/requests/api/graphql/gitlab_schema_spec.rb @@ -8,6 +8,18 @@ describe 'GitlabSchema configurations' do set(:project) { create(:project) } shared_examples 'imposing query limits' do + describe 'timeouts' do + context 'when timeout is reached' do + it 'shows an error' do + Timecop.scale(50000000) do # ludicrously large number because the timeout has to happen before the query even begins + subject + + expect_graphql_errors_to_include /Timeout/ + end + end + end + end + describe '#max_complexity' do context 'when complexity is too high' do it 'shows an error' do diff --git a/spec/requests/api/releases_spec.rb b/spec/requests/api/releases_spec.rb index da04e852795..233f0497b7f 100644 --- a/spec/requests/api/releases_spec.rb +++ b/spec/requests/api/releases_spec.rb @@ -340,6 +340,40 @@ describe API::Releases do expect(response).to have_gitlab_http_status(:ok) end + + context 'when release is associated to a milestone' do + let!(:release) do + create(:release, tag: 'v0.1', project: project, milestones: [milestone]) + end + + let(:milestone) { create(:milestone, project: project) } + + it 'exposes milestones' do + get api("/projects/#{project.id}/releases/v0.1", non_project_member) + + expect(json_response['milestones'].first['title']).to eq(milestone.title) + end + + context 'when project restricts visibility of issues and merge requests' do + let!(:project) { create(:project, :repository, :public, :issues_private, :merge_requests_private) } + + it 'does not expose milestones' do + get api("/projects/#{project.id}/releases/v0.1", non_project_member) + + expect(json_response['milestones']).to be_nil + end + end + + context 'when project restricts visibility of issues' do + let!(:project) { create(:project, :repository, :public, :issues_private) } + + it 'exposes milestones' do + get api("/projects/#{project.id}/releases/v0.1", non_project_member) + + expect(json_response['milestones'].first['title']).to eq(milestone.title) + end + end + end end end end |