diff options
author | Fabio Pitino <fpitino@gitlab.com> | 2019-09-13 09:40:00 +0300 |
---|---|---|
committer | Yorick Peterse <yorick@yorickpeterse.com> | 2019-09-30 15:22:05 +0300 |
commit | c9396f31c6a0088e1529b9d0bbea7f5ba4e58af9 (patch) | |
tree | 584ef4ae34bf82954c80f4e4572feda914b00847 /spec | |
parent | 58290d90e5b642322e397d197eb063a3ff712008 (diff) |
Cancel all running CI jobs when user is blocked
This prevents a MITM attack where attacker could
still access Git repository if any jobs were
running long enough.
Diffstat (limited to 'spec')
-rw-r--r-- | spec/models/user_spec.rb | 18 | ||||
-rw-r--r-- | spec/services/ci/cancel_user_pipelines_service_spec.rb | 23 |
2 files changed, 40 insertions, 1 deletions
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 2b171edcfce..a26b2979855 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -1097,11 +1097,27 @@ describe User do describe 'blocking user' do let(:user) { create(:user, name: 'John Smith') } - it "blocks user" do + it 'blocks user' do user.block expect(user.blocked?).to be_truthy end + + context 'when user has running CI pipelines' do + let(:service) { double } + + before do + pipeline = create(:ci_pipeline, :running, user: user) + create(:ci_build, :running, pipeline: pipeline) + end + + it 'cancels all running pipelines and related jobs' do + expect(Ci::CancelUserPipelinesService).to receive(:new).and_return(service) + expect(service).to receive(:execute).with(user) + + user.block + end + end end describe '.filter_items' do diff --git a/spec/services/ci/cancel_user_pipelines_service_spec.rb b/spec/services/ci/cancel_user_pipelines_service_spec.rb new file mode 100644 index 00000000000..251f21feaef --- /dev/null +++ b/spec/services/ci/cancel_user_pipelines_service_spec.rb @@ -0,0 +1,23 @@ +# frozen_string_literal: true + +require 'spec_helper' + +describe Ci::CancelUserPipelinesService do + describe '#execute' do + let(:user) { create(:user) } + + subject { described_class.new.execute(user) } + + context 'when user has running CI pipelines' do + let(:pipeline) { create(:ci_pipeline, :running, user: user) } + let!(:build) { create(:ci_build, :running, pipeline: pipeline) } + + it 'cancels all running pipelines and related jobs' do + subject + + expect(pipeline.reload).to be_canceled + expect(build.reload).to be_canceled + end + end + end +end |