Add latest changes from gitlab-org/gitlab@master

4 files changed, 84 insertions, 1 deletions

diff --git a/workhorse/internal/dependencyproxy/dependencyproxy.go b/workhorse/internal/dependencyproxy/dependencyproxy.go
index 76def761668..a28d108b431 100644
--- a/workhorse/internal/dependencyproxy/dependencyproxy.go
+++ b/workhorse/internal/dependencyproxy/dependencyproxy.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"time"
 
@@ -157,12 +158,32 @@ func (p *Injector) newUploadRequest(ctx context.Context, params *entryParams, or
 func (p *Injector) unpackParams(sendData string) (*entryParams, error) {
 	var params entryParams
 	if err := p.Unpack(&params, sendData); err != nil {
-		return nil, fmt.Errorf("dependency proxy: unpack sendData: %v", err)
+		return nil, fmt.Errorf("dependency proxy: unpack sendData: %w", err)
+	}
+
+	if err := p.validateParams(params); err != nil {
+		return nil, fmt.Errorf("dependency proxy: invalid params: %w", err)
 	}
 
 	return &params, nil
 }
 
+func (p *Injector) validateParams(params entryParams) error {
+	var uploadMethod = params.UploadConfig.Method
+	if uploadMethod != "" && uploadMethod != http.MethodPost && uploadMethod != http.MethodPut {
+		return fmt.Errorf("invalid upload method %s", uploadMethod)
+	}
+
+	var uploadUrl = params.UploadConfig.Url
+	if uploadUrl != "" {
+		if _, err := url.ParseRequestURI(uploadUrl); err != nil {
+			return fmt.Errorf("invalid upload url %w", err)
+		}
+	}
+
+	return nil
+}
+
 func (p *Injector) uploadMethodFrom(params *entryParams) string {
 	if params.UploadConfig.Method != "" {
 		return params.UploadConfig.Method
diff --git a/workhorse/internal/dependencyproxy/dependencyproxy_test.go b/workhorse/internal/dependencyproxy/dependencyproxy_test.go
index 8a64517d578..b028fbcf355 100644
--- a/workhorse/internal/dependencyproxy/dependencyproxy_test.go
+++ b/workhorse/internal/dependencyproxy/dependencyproxy_test.go
@@ -261,6 +261,20 @@ func TestInvalidUploadConfiguration(t *testing.T) {
 		sendData map[string]interface{}
 	}{
 		{
+			desc: "with an invalid overriden method",
+			sendData: mergeMap(baseSendData, map[string]interface{}{
+				"UploadConfig": map[string]string{
+					"Method": "TEAPOT",
+				},
+			}),
+		}, {
+			desc: "with an invalid url",
+			sendData: mergeMap(baseSendData, map[string]interface{}{
+				"UploadConfig": map[string]string{
+					"Url": "invalid_url",
+				},
+			}),
+		}, {
 			desc: "with an invalid headers",
 			sendData: mergeMap(baseSendData, map[string]interface{}{
 				"UploadConfig": map[string]interface{}{
diff --git a/workhorse/internal/proxy/proxy.go b/workhorse/internal/proxy/proxy.go
index a7c3b322da7..0610ad1af39 100644
--- a/workhorse/internal/proxy/proxy.go
+++ b/workhorse/internal/proxy/proxy.go
@@ -5,14 +5,23 @@ import (
 	"net/http"
 	"net/http/httputil"
 	"net/url"
+	"sync"
 	"time"
 
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/helper"
 	"gitlab.com/gitlab-org/gitlab/workhorse/internal/helper/nginx"
 )
 
+const (
+	// matches the default size used in httputil.ReverseProxy
+	bufferPoolSize = 32 * 1024
+)
+
 var (
 	defaultTarget = helper.URLMustParse("http://localhost")
+
+	// pool is a buffer pool that is shared across all Proxy instances to maximize buffer reuse.
+	pool = newBufferPool()
 )
 
 type Proxy struct {
@@ -46,6 +55,7 @@ func NewProxy(myURL *url.URL, version string, roundTripper http.RoundTripper, op
 	u.Path = ""
 	p.reverseProxy = httputil.NewSingleHostReverseProxy(&u)
 	p.reverseProxy.Transport = roundTripper
+	p.reverseProxy.BufferPool = pool
 	chainDirector(p.reverseProxy, func(r *http.Request) {
 		r.Header.Set("Gitlab-Workhorse", p.Version)
 		r.Header.Set("Gitlab-Workhorse-Proxy-Start", fmt.Sprintf("%d", time.Now().UnixNano()))
@@ -104,3 +114,25 @@ func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	p.reverseProxy.ServeHTTP(w, r)
 }
+
+type bufferPool struct {
+	pool sync.Pool
+}
+
+func newBufferPool() *bufferPool {
+	return &bufferPool{
+		pool: sync.Pool{
+			New: func() any {
+				return make([]byte, bufferPoolSize)
+			},
+		},
+	}
+}
+
+func (bp *bufferPool) Get() []byte {
+	return bp.pool.Get().([]byte)
+}
+
+func (bp *bufferPool) Put(v []byte) {
+	bp.pool.Put(v) //lint:ignore SA6002 we either allocate manually to satisfy the linter or let the compiler allocate for us and silence the linter
+}
diff --git a/workhorse/internal/proxy/proxy_test.go b/workhorse/internal/proxy/proxy_test.go
new file mode 100644
index 00000000000..52c8e458a76
--- /dev/null
+++ b/workhorse/internal/proxy/proxy_test.go
@@ -0,0 +1,16 @@
+package proxy
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBufferPool(t *testing.T) {
+	bp := newBufferPool()
+
+	b := bp.Get()
+	assert.Len(t, b, bufferPoolSize)
+
+	bp.Put(b) // just test that it doesn't panic or something like that
+}