1 files changed, 31 insertions, 0 deletions
diff --git a/lib/gitlab/ci/yaml_processor.rb b/lib/gitlab/ci/yaml_processor.rb
index 3a0173d1548..289f41b4ec7 100644
--- a/lib/gitlab/ci/yaml_processor.rb
+++ b/lib/gitlab/ci/yaml_processor.rb
@@ -8,6 +8,8 @@
 module Gitlab
   module Ci
     class YamlProcessor
+      include Gitlab::Utils::StrongMemoize
+
       ValidationError = Class.new(StandardError)
 
       def initialize(config_content, opts = {})
@@ -28,6 +30,8 @@ module Gitlab
           return Result.new(errors: ['Please provide content of .gitlab-ci.yml'])
         end
 
+        verify_project_sha! if verify_project_sha?
+
         @ci_config = Gitlab::Ci::Config.new(@config_content, **@opts)
 
         unless @ci_config.valid?
@@ -47,6 +51,15 @@ module Gitlab
         @opts[:project]
       end
 
+      def sha
+        @opts[:sha]
+      end
+
+      def verify_project_sha?
+        @opts.delete(:verify_project_sha) || false
+      end
+      strong_memoize_attr :verify_project_sha?
+
       def run_logical_validations!
         @stages = @ci_config.stages
         @jobs = @ci_config.normalized_jobs
@@ -191,6 +204,24 @@ module Gitlab
       def error!(message)
         raise ValidationError, message
       end
+
+      def verify_project_sha!
+        return unless project && sha && project.repository_exists? && project.commit(sha)
+
+        unless project_ref_contains_sha?
+          error!('Could not validate configuration. Config originates from external project')
+        end
+      end
+
+      def project_ref_contains_sha?
+        # A 5-minute cache TTL is sufficient to prevent Gitaly load issues while also mitigating rare
+        # use cases concerning stale data. For example, when an external commit gets merged into the
+        # project, there may be at most a 5-minute window where the `sha` is still considered external.
+        Rails.cache.fetch(['project', project.id, 'ref/contains/sha', sha], expires_in: 5.minutes) do
+          repo = project.repository
+          repo.branch_names_contains(sha, limit: 1).any? || repo.tag_names_contains(sha, limit: 1).any?
+        end
+      end
     end
   end
 end