Merge branch 'security-pipeline-trigger-tokens-exposure-11-6' into 'security-11-6'

[11.6] Do not expose trigger token when user should not see it

See merge request gitlab/gitlabhq!2759

(cherry picked from commit 33fbd62b9b4a73679a9f3cd1d9020e5dc6e9072d)

64a328be Do not expose trigger token when user should not see it

2 files changed, 60 insertions, 5 deletions

diff --git a/spec/presenters/ci/trigger_presenter_spec.rb b/spec/presenters/ci/trigger_presenter_spec.rb
new file mode 100644
index 00000000000..231b539c188
--- /dev/null
+++ b/spec/presenters/ci/trigger_presenter_spec.rb
@@ -0,0 +1,51 @@
+require 'spec_helper'
+
+describe Ci::TriggerPresenter do
+  set(:user) { create(:user) }
+  set(:project) { create(:project) }
+
+  set(:trigger) do
+    create(:ci_trigger, token: '123456789abcd', project: project)
+  end
+
+  subject do
+    described_class.new(trigger, current_user: user)
+  end
+
+  before do
+    project.add_maintainer(user)
+  end
+
+  context 'when user is not a trigger owner' do
+    describe '#token' do
+      it 'exposes only short token' do
+        expect(subject.token).not_to eq trigger.token
+        expect(subject.token).to eq '1234'
+      end
+    end
+
+    describe '#has_token_exposed?' do
+      it 'does not have token exposed' do
+        expect(subject).not_to have_token_exposed
+      end
+    end
+  end
+
+  context 'when user is a trigger owner and builds admin' do
+    before do
+      trigger.update(owner: user)
+    end
+
+    describe '#token' do
+      it 'exposes full token' do
+        expect(subject.token).to eq trigger.token
+      end
+    end
+
+    describe '#has_token_exposed?' do
+      it 'has token exposed' do
+        expect(subject).to have_token_exposed
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index 658df6945d2..ecc0df3763d 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -1,8 +1,9 @@
 require 'spec_helper'
 
 describe API::Triggers do
-  let(:user) { create(:user) }
-  let(:user2) { create(:user) }
+  set(:user) { create(:user) }
+  set(:user2) { create(:user) }
+
   let!(:trigger_token) { 'secure_token' }
   let!(:trigger_token_2) { 'secure_token_2' }
   let!(:project) { create(:project, :repository, creator: user) }
@@ -132,14 +133,17 @@ describe API::Triggers do
   end
 
   describe 'GET /projects/:id/triggers' do
-    context 'authenticated user with valid permissions' do
-      it 'returns list of triggers' do
+    context 'authenticated user who can access triggers' do
+      it 'returns a list of triggers with tokens exposed correctly' do
         get api("/projects/#{project.id}/triggers", user)
 
         expect(response).to have_gitlab_http_status(200)
         expect(response).to include_pagination_headers
+
         expect(json_response).to be_a(Array)
-        expect(json_response[0]).to have_key('token')
+        expect(json_response.size).to eq 2
+        expect(json_response.dig(0, 'token')).to eq trigger_token
+        expect(json_response.dig(1, 'token')).to eq trigger_token_2[0..3]
       end
     end