From bc33f1bd89fb149bbd351136265b0f3a66ee1df8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matija=20=C4=8Cupi=C4=87?= <matteeyah@gmail.com>
Date: Sat, 8 Jun 2019 18:13:31 +0200
Subject: Gate MR head_pipeline behind read_pipeline ability

---
 lib/api/entities.rb                      |  4 +++-
 spec/requests/api/merge_requests_spec.rb | 25 +++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 90ed24a2ded..32e96dae744 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -735,7 +735,9 @@ module API
         merge_request.metrics&.pipeline
       end
 
-      expose :head_pipeline, using: 'API::Entities::Pipeline'
+      expose :head_pipeline, using: 'API::Entities::Pipeline', if: -> (_, options) do
+        Ability.allowed?(options[:current_user], :read_pipeline, options[:project])
+      end
 
       expose :diff_refs, using: Entities::DiffRefs
 
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 5c94a87529b..e37c7ed36d9 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -834,6 +834,31 @@ describe API::MergeRequests do
       end
     end
 
+    context 'head_pipeline' do
+      before do
+        merge_request.update(head_pipeline: create(:ci_pipeline))
+        merge_request.project.project_feature.update(builds_access_level: 10)
+      end
+
+      context 'when user can read the pipeline' do
+        it 'exposes pipeline information' do
+          get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user)
+
+          expect(json_response).to include('head_pipeline')
+        end
+      end
+
+      context 'when user can not read the pipeline' do
+        let(:guest) { create(:user) }
+
+        it 'does not expose pipeline information' do
+          get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", guest)
+
+          expect(json_response).not_to include('head_pipeline')
+        end
+      end
+    end
+
     it 'returns the commits behind the target branch when include_diverged_commits_count is present' do
       allow_any_instance_of(merge_request.class).to receive(:diverged_commits_count).and_return(1)
 
-- 
cgit v1.2.3


From 68a22519f5e2a3f64b38f3d0a707f6e0af654ba6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matija=20=C4=8Cupi=C4=87?= <matteeyah@gmail.com>
Date: Wed, 12 Jun 2019 18:14:21 +0200
Subject: Add CHANGELOG entry

---
 changelogs/unreleased/security-11-11-mr-head-pipeline-leak.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/security-11-11-mr-head-pipeline-leak.yml

diff --git a/changelogs/unreleased/security-11-11-mr-head-pipeline-leak.yml b/changelogs/unreleased/security-11-11-mr-head-pipeline-leak.yml
new file mode 100644
index 00000000000..fe8c4dfb3c8
--- /dev/null
+++ b/changelogs/unreleased/security-11-11-mr-head-pipeline-leak.yml
@@ -0,0 +1,5 @@
+---
+title: Gate MR head_pipeline behind read_pipeline ability.
+merge_request:
+author:
+type: security
-- 
cgit v1.2.3