From 1eef146c2d1de19d4e995d421e5787053e50db80 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Mon, 10 Jan 2022 20:36:29 +0000 Subject: Add latest changes from gitlab-org/security/gitlab@14-6-stable-ee --- .../dashboard/projects_controller_spec.rb | 4 -- spec/controllers/dashboard_controller_spec.rb | 3 - spec/controllers/groups_controller_spec.rb | 20 ------ .../projects/commits_controller_spec.rb | 23 ------- .../controllers/projects/issues_controller_spec.rb | 36 ----------- spec/controllers/projects/raw_controller_spec.rb | 71 ++++++++++++++++++++-- .../projects/repositories_controller_spec.rb | 48 +++++++++++++++ spec/controllers/projects/tags_controller_spec.rb | 22 ------- spec/controllers/projects_controller_spec.rb | 22 ------- 9 files changed, 113 insertions(+), 136 deletions(-) (limited to 'spec/controllers') diff --git a/spec/controllers/dashboard/projects_controller_spec.rb b/spec/controllers/dashboard/projects_controller_spec.rb index 9b13025cbe3..743759d5023 100644 --- a/spec/controllers/dashboard/projects_controller_spec.rb +++ b/spec/controllers/dashboard/projects_controller_spec.rb @@ -8,10 +8,6 @@ RSpec.describe Dashboard::ProjectsController, :aggregate_failures do let_it_be(:user) { create(:user) } describe '#index' do - context 'user not logged in' do - it_behaves_like 'authenticates sessionless user', :index, :atom - end - context 'user logged in' do let_it_be(:project) { create(:project, name: 'Project 1') } let_it_be(:project2) { create(:project, name: 'Project Two') } diff --git a/spec/controllers/dashboard_controller_spec.rb b/spec/controllers/dashboard_controller_spec.rb index c838affa239..8fae617ea65 100644 --- a/spec/controllers/dashboard_controller_spec.rb +++ b/spec/controllers/dashboard_controller_spec.rb @@ -72,9 +72,6 @@ RSpec.describe DashboardController do end end - it_behaves_like 'authenticates sessionless user', :issues, :atom, author_id: User.first - it_behaves_like 'authenticates sessionless user', :issues_calendar, :ics - describe "#check_filters_presence!" do let(:user) { create(:user) } diff --git a/spec/controllers/groups_controller_spec.rb b/spec/controllers/groups_controller_spec.rb index a7625e65603..62171528695 100644 --- a/spec/controllers/groups_controller_spec.rb +++ b/spec/controllers/groups_controller_spec.rb @@ -1209,26 +1209,6 @@ RSpec.describe GroupsController, factory_default: :keep do end end - context 'token authentication' do - it_behaves_like 'authenticates sessionless user', :show, :atom, public: true do - before do - default_params.merge!(id: group) - end - end - - it_behaves_like 'authenticates sessionless user', :issues, :atom, public: true do - before do - default_params.merge!(id: group, author_id: user.id) - end - end - - it_behaves_like 'authenticates sessionless user', :issues_calendar, :ics, public: true do - before do - default_params.merge!(id: group) - end - end - end - describe 'external authorization' do before do group.add_owner(user) diff --git a/spec/controllers/projects/commits_controller_spec.rb b/spec/controllers/projects/commits_controller_spec.rb index a8e71d73beb..fd840fafa61 100644 --- a/spec/controllers/projects/commits_controller_spec.rb +++ b/spec/controllers/projects/commits_controller_spec.rb @@ -162,27 +162,4 @@ RSpec.describe Projects::CommitsController do end end end - - context 'token authentication' do - context 'public project' do - it_behaves_like 'authenticates sessionless user', :show, :atom, { public: true, ignore_incrementing: true } do - before do - public_project = create(:project, :repository, :public) - - default_params.merge!(namespace_id: public_project.namespace, project_id: public_project, id: "master.atom") - end - end - end - - context 'private project' do - it_behaves_like 'authenticates sessionless user', :show, :atom, { public: false, ignore_incrementing: true } do - before do - private_project = create(:project, :repository, :private) - private_project.add_maintainer(user) - - default_params.merge!(namespace_id: private_project.namespace, project_id: private_project, id: "master.atom") - end - end - end - end end diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb index 763c3e43e27..d91c1b0d29a 100644 --- a/spec/controllers/projects/issues_controller_spec.rb +++ b/spec/controllers/projects/issues_controller_spec.rb @@ -1948,40 +1948,4 @@ RSpec.describe Projects::IssuesController do end end end - - context 'private project with token authentication' do - let_it_be(:private_project) { create(:project, :private) } - - it_behaves_like 'authenticates sessionless user', :index, :atom, ignore_incrementing: true do - before do - default_params.merge!(project_id: private_project, namespace_id: private_project.namespace) - - private_project.add_maintainer(user) - end - end - - it_behaves_like 'authenticates sessionless user', :calendar, :ics, ignore_incrementing: true do - before do - default_params.merge!(project_id: private_project, namespace_id: private_project.namespace) - - private_project.add_maintainer(user) - end - end - end - - context 'public project with token authentication' do - let_it_be(:public_project) { create(:project, :public) } - - it_behaves_like 'authenticates sessionless user', :index, :atom, public: true do - before do - default_params.merge!(project_id: public_project, namespace_id: public_project.namespace) - end - end - - it_behaves_like 'authenticates sessionless user', :calendar, :ics, public: true do - before do - default_params.merge!(project_id: public_project, namespace_id: public_project.namespace) - end - end - end end diff --git a/spec/controllers/projects/raw_controller_spec.rb b/spec/controllers/projects/raw_controller_spec.rb index 79da18f2d6d..4d99afb6b1f 100644 --- a/spec/controllers/projects/raw_controller_spec.rb +++ b/spec/controllers/projects/raw_controller_spec.rb @@ -193,6 +193,8 @@ RSpec.describe Projects::RawController do let_it_be(:user) { create(:user, static_object_token: 'very-secure-token') } let_it_be(:file_path) { 'master/README.md' } + let(:token) { user.static_object_token } + before do project.add_developer(user) end @@ -207,17 +209,46 @@ RSpec.describe Projects::RawController do end context 'when a token param is present' do + subject(:execute_raw_request_with_token_in_params) do + execute_raw_requests(requests: 1, project: project, file_path: file_path, token: token) + end + context 'when token is correct' do it 'calls the action normally' do - execute_raw_requests(requests: 1, project: project, file_path: file_path, token: user.static_object_token) + execute_raw_request_with_token_in_params expect(response).to have_gitlab_http_status(:ok) end + + context 'when user with expired password' do + let_it_be(:user) { create(:user, password_expires_at: 2.minutes.ago) } + + it 'redirects to sign in page' do + execute_raw_request_with_token_in_params + + expect(response).to have_gitlab_http_status(:found) + expect(response.location).to end_with('/users/sign_in') + end + end + + context 'when password expiration is not applicable' do + context 'when ldap user' do + let_it_be(:user) { create(:omniauth_user, provider: 'ldap', password_expires_at: 2.minutes.ago) } + + it 'calls the action normally' do + execute_raw_request_with_token_in_params + + expect(response).to have_gitlab_http_status(:ok) + end + end + end end context 'when token is incorrect' do + let(:token) { 'foobar' } + it 'redirects to sign in page' do - execute_raw_requests(requests: 1, project: project, file_path: file_path, token: 'foobar') + execute_raw_request_with_token_in_params expect(response).to have_gitlab_http_status(:found) expect(response.location).to end_with('/users/sign_in') @@ -226,19 +257,47 @@ RSpec.describe Projects::RawController do end context 'when a token header is present' do + subject(:execute_raw_request_with_token_in_headers) do + request.headers['X-Gitlab-Static-Object-Token'] = token + execute_raw_requests(requests: 1, project: project, file_path: file_path) + end + context 'when token is correct' do it 'calls the action normally' do - request.headers['X-Gitlab-Static-Object-Token'] = user.static_object_token - execute_raw_requests(requests: 1, project: project, file_path: file_path) + execute_raw_request_with_token_in_headers expect(response).to have_gitlab_http_status(:ok) end + + context 'when user with expired password' do + let_it_be(:user) { create(:user, password_expires_at: 2.minutes.ago) } + + it 'redirects to sign in page' do + execute_raw_request_with_token_in_headers + + expect(response).to have_gitlab_http_status(:found) + expect(response.location).to end_with('/users/sign_in') + end + end + + context 'when password expiration is not applicable' do + context 'when ldap user' do + let_it_be(:user) { create(:omniauth_user, provider: 'ldap', password_expires_at: 2.minutes.ago) } + + it 'calls the action normally' do + execute_raw_request_with_token_in_headers + + expect(response).to have_gitlab_http_status(:ok) + end + end + end end context 'when token is incorrect' do + let(:token) { 'foobar' } + it 'redirects to sign in page' do - request.headers['X-Gitlab-Static-Object-Token'] = 'foobar' - execute_raw_requests(requests: 1, project: project, file_path: file_path) + execute_raw_request_with_token_in_headers expect(response).to have_gitlab_http_status(:found) expect(response.location).to end_with('/users/sign_in') diff --git a/spec/controllers/projects/repositories_controller_spec.rb b/spec/controllers/projects/repositories_controller_spec.rb index b7eef3812a4..f7cf55d8a95 100644 --- a/spec/controllers/projects/repositories_controller_spec.rb +++ b/spec/controllers/projects/repositories_controller_spec.rb @@ -178,6 +178,29 @@ RSpec.describe Projects::RepositoriesController do expect(response).to have_gitlab_http_status(:ok) end + + context 'when user with expired password' do + let_it_be(:user) { create(:user, password_expires_at: 2.minutes.ago) } + + it 'redirects to sign in page' do + get :archive, params: { namespace_id: project.namespace, project_id: project, id: 'master', token: user.static_object_token }, format: 'zip' + + expect(response).to have_gitlab_http_status(:found) + expect(response.location).to end_with('/users/sign_in') + end + end + + context 'when password expiration is not applicable' do + context 'when ldap user' do + let_it_be(:user) { create(:omniauth_user, provider: 'ldap', password_expires_at: 2.minutes.ago) } + + it 'calls the action normally' do + get :archive, params: { namespace_id: project.namespace, project_id: project, id: 'master', token: user.static_object_token }, format: 'zip' + + expect(response).to have_gitlab_http_status(:ok) + end + end + end end context 'when token is incorrect' do @@ -197,6 +220,31 @@ RSpec.describe Projects::RepositoriesController do expect(response).to have_gitlab_http_status(:ok) end + + context 'when user with expired password' do + let_it_be(:user) { create(:user, password_expires_at: 2.minutes.ago) } + + it 'redirects to sign in page' do + request.headers['X-Gitlab-Static-Object-Token'] = user.static_object_token + get :archive, params: { namespace_id: project.namespace, project_id: project, id: 'master' }, format: 'zip' + + expect(response).to have_gitlab_http_status(:found) + expect(response.location).to end_with('/users/sign_in') + end + end + + context 'when password expiration is not applicable' do + context 'when ldap user' do + let_it_be(:user) { create(:omniauth_user, provider: 'ldap', password_expires_at: 2.minutes.ago) } + + it 'calls the action normally' do + request.headers['X-Gitlab-Static-Object-Token'] = user.static_object_token + get :archive, params: { namespace_id: project.namespace, project_id: project, id: 'master' }, format: 'zip' + + expect(response).to have_gitlab_http_status(:ok) + end + end + end end context 'when token is incorrect' do diff --git a/spec/controllers/projects/tags_controller_spec.rb b/spec/controllers/projects/tags_controller_spec.rb index 0045c0a484b..9823c36cb86 100644 --- a/spec/controllers/projects/tags_controller_spec.rb +++ b/spec/controllers/projects/tags_controller_spec.rb @@ -117,28 +117,6 @@ RSpec.describe Projects::TagsController do end end - context 'private project with token authentication' do - let(:private_project) { create(:project, :repository, :private) } - - it_behaves_like 'authenticates sessionless user', :index, :atom, ignore_incrementing: true do - before do - default_params.merge!(project_id: private_project, namespace_id: private_project.namespace) - - private_project.add_maintainer(user) - end - end - end - - context 'public project with token authentication' do - let(:public_project) { create(:project, :repository, :public) } - - it_behaves_like 'authenticates sessionless user', :index, :atom, public: true do - before do - default_params.merge!(project_id: public_project, namespace_id: public_project.namespace) - end - end - end - describe 'POST #create' do before do project.add_developer(user) diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb index fd0f9985392..7ebd86640ad 100644 --- a/spec/controllers/projects_controller_spec.rb +++ b/spec/controllers/projects_controller_spec.rb @@ -1568,28 +1568,6 @@ RSpec.describe ProjectsController do end end - context 'private project with token authentication' do - let_it_be(:private_project) { create(:project, :private) } - - it_behaves_like 'authenticates sessionless user', :show, :atom, ignore_incrementing: true do - before do - default_params.merge!(id: private_project, namespace_id: private_project.namespace) - - private_project.add_maintainer(user) - end - end - end - - context 'public project with token authentication' do - let_it_be(:public_project) { create(:project, :public) } - - it_behaves_like 'authenticates sessionless user', :show, :atom, public: true do - before do - default_params.merge!(id: public_project, namespace_id: public_project.namespace) - end - end - end - context 'GET show.atom' do let_it_be(:public_project) { create(:project, :public) } let_it_be(:event) { create(:event, :commented, project: public_project, target: create(:note, project: public_project)) } -- cgit v1.2.3