From 4365c59b4f8cfa83bfbb95aae07b03a9b1a8436e Mon Sep 17 00:00:00 2001 From: Pirate Praveen Date: Mon, 1 Feb 2021 15:46:34 +0530 Subject: [PATCH 1/5] Use gitlab-rails-console command in README.Debian --- debian/README.Debian | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/README.Debian b/debian/README.Debian index 1093592e1c..c63bfd710c 100644 --- a/debian/README.Debian +++ b/debian/README.Debian @@ -132,7 +132,7 @@ Migrating from non-Debian gitlab Resetting admin password without web interface ============================================== The steps involve dropping into rails console as gitlab user for production environment and then resetting the admin password via the user object. - $ runuser -u gitlab -- sh -c 'cd /usr/share/gitlab && . /etc/gitlab/gitlab-debian.conf && export DB RAILS_ENV && bundle exec rails console production' + $ gitlab-rails-console irb(main):001:0> user = User.where(admin: true).first irb(main):002:0> user.password = 'secret_pass' irb(main):003:0> user.password_confirmation = 'secret_pass' @@ -141,7 +141,7 @@ The steps involve dropping into rails console as gitlab user for production envi Granting an existing user admin access ====================================== The steps involve dropping into rails console as gitlab user for production environment and running the following commands. - $ runuser -u gitlab -- sh -c 'cd /usr/share/gitlab && . /etc/gitlab/gitlab-debian.conf && export DB RAILS_ENV && bundle exec rails console production' + $ gitlab-rails-console irb(main):001:0> user = User.find_by(email: 'useraddress@domain') irb(main):003:0> user.admin=true irb(main):004:0> user.save From e535fd4fd50f02b1ec7b94db1083066d7cbf0368 Mon Sep 17 00:00:00 2001 From: Pirate Praveen Date: Mon, 1 Feb 2021 15:48:44 +0530 Subject: [PATCH 2/5] Document how to activate a new user from rails console --- debian/README.Debian | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/debian/README.Debian b/debian/README.Debian index c63bfd710c..b927867cb9 100644 --- a/debian/README.Debian +++ b/debian/README.Debian @@ -138,13 +138,22 @@ The steps involve dropping into rails console as gitlab user for production envi irb(main):003:0> user.password_confirmation = 'secret_pass' irb(main):004:0> user.save! +Activating a newly registered user +====================================== +The steps involve dropping into rails console as gitlab user for production environment and running the following commands. + $ gitlab-rails-console + irb(main):001:0> user = User.find_by(email: 'useraddress@domain') + irb(main):004:0> user.state='active' + irb(main):005:0> user.save + Granting an existing user admin access ====================================== The steps involve dropping into rails console as gitlab user for production environment and running the following commands. $ gitlab-rails-console irb(main):001:0> user = User.find_by(email: 'useraddress@domain') irb(main):003:0> user.admin=true - irb(main):004:0> user.save + irb(main):004:0> user.state='active' + irb(main):005:0> user.save Latest information regarding supported versions =============================================== From 8e4dd2d649cc956e4cde467459d1e3c6477e866a Mon Sep 17 00:00:00 2001 From: Pirate Praveen Date: Thu, 4 Feb 2021 15:26:42 +0530 Subject: [PATCH 3/5] Update minimum version of ruby-attr-encrypted --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 448ff02e41..82470fceff 100644 --- a/debian/control +++ b/debian/control @@ -83,7 +83,7 @@ Depends: ${shlibs:Depends}, ${misc:Depends}, # Two-factor authentication ruby-devise-two-factor (>= 3.1~), ruby-rqrcode-rails3 (>= 0.1.7~), - ruby-attr-encrypted (>= 3.1~), + ruby-attr-encrypted (>= 3.1.0-3~), ruby-u2f (>= 0.2.1~), # GitLab Pages ruby-validates-hostname (>= 1.0.10~), From 3571a16ade385deb5622c7841cccdfef01b354fb Mon Sep 17 00:00:00 2001 From: Pirate Praveen Date: Thu, 4 Feb 2021 15:43:07 +0530 Subject: [PATCH 4/5] New upstream version 13.6.6 --- CHANGELOG.md | 11 +++ GITALY_SERVER_VERSION | 2 +- VERSION | 2 +- .../mr_widget_pipeline_container.vue | 3 +- .../projects/releases_controller.rb | 3 + app/presenters/release_presenter.rb | 2 + config/routes.rb | 1 + config/routes/unmatched_project.rb | 18 +++++ .../query_analyzers/logger_analyzer.rb | 14 +++- lib/gitlab/url_blocker.rb | 4 +- .../projects/releases_controller_spec.rb | 9 +++ .../mr_widget_pipeline_container_spec.js | 12 ++++ .../query_analyzers/logger_analyzer_spec.rb | 18 +++++ spec/lib/gitlab/url_blocker_spec.rb | 15 ++++ spec/presenters/release_presenter_spec.rb | 6 ++ spec/requests/git_http_spec.rb | 8 ++- spec/routing/project_routing_spec.rb | 69 +++++++++++++++++++ .../route_to_route_not_found_matcher.rb | 15 ++++ 18 files changed, 203 insertions(+), 9 deletions(-) create mode 100644 config/routes/unmatched_project.rb create mode 100644 spec/support/matchers/route_to_route_not_found_matcher.rb diff --git a/CHANGELOG.md b/CHANGELOG.md index d995ed28de..e520b162a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 13.6.6 (2021-02-01) + +### Security (5 changes) + +- Filter sensitive GraphQL variables from logs. +- Avoid exposing release links when the user cannot read git-tag/repository. +- Sanitize target branch on MR page. +- Fix DNS rebinding protection bypass when allowing an IP address in Outbound Requests setting. +- Add routes for unmatched url for not-get requests. + + ## 13.6.5 (2021-01-13) ### Security (1 change) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index b22e91bfa5..4c39112331 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -13.6.5 \ No newline at end of file +13.6.6 \ No newline at end of file diff --git a/VERSION b/VERSION index b22e91bfa5..4c39112331 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -13.6.5 \ No newline at end of file +13.6.6 \ No newline at end of file diff --git a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue index 55efd7e7d3..953710ccbf 100644 --- a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue +++ b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue @@ -1,5 +1,6 @@ ', + }, + }); + + expect(wrapper.find(MrWidgetPipeline).props().sourceBranchLink).toBe('Foo'); + }); + it('renders deployments', () => { const expectedProps = mockStore.postMergeDeployments.map(dep => expect.objectContaining({ diff --git a/spec/lib/gitlab/graphql/query_analyzers/logger_analyzer_spec.rb b/spec/lib/gitlab/graphql/query_analyzers/logger_analyzer_spec.rb index c843251318..138765afd8 100644 --- a/spec/lib/gitlab/graphql/query_analyzers/logger_analyzer_spec.rb +++ b/spec/lib/gitlab/graphql/query_analyzers/logger_analyzer_spec.rb @@ -40,4 +40,22 @@ RSpec.describe Gitlab::Graphql::QueryAnalyzers::LoggerAnalyzer do end end end + + describe '#initial_value' do + it 'filters out sensitive variables' do + doc = GraphQL.parse <<-GRAPHQL + mutation createNote($body: String!) { + createNote(input: {noteableId: "1", body: $body}) { + note { + id + } + } + } + GRAPHQL + + query = GraphQL::Query.new(GitlabSchema, document: doc, context: {}, variables: { body: "some note" }) + + expect(subject.initial_value(query)[:variables]).to eq('{:body=>"[FILTERED]"}') + end + end end diff --git a/spec/lib/gitlab/url_blocker_spec.rb b/spec/lib/gitlab/url_blocker_spec.rb index f466d11785..686382dc26 100644 --- a/spec/lib/gitlab/url_blocker_spec.rb +++ b/spec/lib/gitlab/url_blocker_spec.rb @@ -91,6 +91,21 @@ RSpec.describe Gitlab::UrlBlocker, :stub_invalid_dns_only do end end + context 'DNS rebinding protection with IP allowed' do + let(:import_url) { 'http://a.192.168.0.120.3times.127.0.0.1.1time.repeat.rebind.network:9121/scrape?target=unix:///var/opt/gitlab/redis/redis.socket&check-keys=*' } + + before do + stub_dns(import_url, ip_address: '192.168.0.120') + + allow(Gitlab::UrlBlockers::UrlAllowlist).to receive(:ip_allowed?).and_return(true) + end + + it_behaves_like 'validates URI and hostname' do + let(:expected_uri) { 'http://192.168.0.120:9121/scrape?target=unix:///var/opt/gitlab/redis/redis.socket&check-keys=*' } + let(:expected_hostname) { 'a.192.168.0.120.3times.127.0.0.1.1time.repeat.rebind.network' } + end + end + context 'disabled DNS rebinding protection' do subject { described_class.validate!(import_url, dns_rebind_protection: false) } diff --git a/spec/presenters/release_presenter_spec.rb b/spec/presenters/release_presenter_spec.rb index b518584569..4bf12183ef 100644 --- a/spec/presenters/release_presenter_spec.rb +++ b/spec/presenters/release_presenter_spec.rb @@ -62,6 +62,12 @@ RSpec.describe ReleasePresenter do it 'returns its own url' do is_expected.to eq(project_release_url(project, release)) end + + context 'when user is guest' do + let(:user) { guest } + + it { is_expected.to be_nil } + end end describe '#opened_merge_requests_url' do diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb index 32aeeed43b..3049ca46d7 100644 --- a/spec/requests/git_http_spec.rb +++ b/spec/requests/git_http_spec.rb @@ -159,13 +159,17 @@ RSpec.describe 'Git HTTP requests' do context "POST git-upload-pack" do it "fails to find a route" do - expect { clone_post(repository_path) }.to raise_error(ActionController::RoutingError) + clone_post(repository_path) do |response| + expect(response).to have_gitlab_http_status(:not_found) + end end end context "POST git-receive-pack" do it "fails to find a route" do - expect { push_post(repository_path) }.to raise_error(ActionController::RoutingError) + push_post(repository_path) do |response| + expect(response).to have_gitlab_http_status(:not_found) + end end end end diff --git a/spec/routing/project_routing_spec.rb b/spec/routing/project_routing_spec.rb index a683dc28f4..b414e8403b 100644 --- a/spec/routing/project_routing_spec.rb +++ b/spec/routing/project_routing_spec.rb @@ -876,4 +876,73 @@ RSpec.describe 'project routing' do ) end end + + context 'with a non-existent project' do + it 'routes to 404 with get request' do + expect(get: "/gitlab/not_exist").to route_to( + 'application#route_not_found', + unmatched_route: 'gitlab/not_exist' + ) + end + + it 'routes to 404 with delete request' do + expect(delete: "/gitlab/not_exist").to route_to( + 'application#route_not_found', + namespace_id: 'gitlab', + project_id: 'not_exist' + ) + end + + it 'routes to 404 with post request' do + expect(post: "/gitlab/not_exist").to route_to( + 'application#route_not_found', + namespace_id: 'gitlab', + project_id: 'not_exist' + ) + end + + it 'routes to 404 with put request' do + expect(put: "/gitlab/not_exist").to route_to( + 'application#route_not_found', + namespace_id: 'gitlab', + project_id: 'not_exist' + ) + end + + context 'with route to some action' do + it 'routes to 404 with get request to' do + expect(get: "/gitlab/not_exist/some_action").to route_to( + 'application#route_not_found', + unmatched_route: 'gitlab/not_exist/some_action' + ) + end + + it 'routes to 404 with delete request' do + expect(delete: "/gitlab/not_exist/some_action").to route_to( + 'application#route_not_found', + namespace_id: 'gitlab', + project_id: 'not_exist', + all: 'some_action' + ) + end + + it 'routes to 404 with post request' do + expect(post: "/gitlab/not_exist/some_action").to route_to( + 'application#route_not_found', + namespace_id: 'gitlab', + project_id: 'not_exist', + all: 'some_action' + ) + end + + it 'routes to 404 with put request' do + expect(put: "/gitlab/not_exist/some_action").to route_to( + 'application#route_not_found', + namespace_id: 'gitlab', + project_id: 'not_exist', + all: 'some_action' + ) + end + end + end end diff --git a/spec/support/matchers/route_to_route_not_found_matcher.rb b/spec/support/matchers/route_to_route_not_found_matcher.rb new file mode 100644 index 0000000000..4105f0f919 --- /dev/null +++ b/spec/support/matchers/route_to_route_not_found_matcher.rb @@ -0,0 +1,15 @@ +# frozen_string_literal: true + +RSpec::Matchers.define :route_to_route_not_found do + match do |actual| + expect(actual).to route_to(controller: 'application', action: 'route_not_found') + rescue RSpec::Expectations::ExpectationNotMetError => e + # `route_to` matcher requires providing all params for exact match. As we use it in shared examples and we provide different paths, + # this matcher checks if provided route matches controller and action, without checking params. + expect(e.message).to include("-{\"controller\"=>\"application\", \"action\"=>\"route_not_found\"}\n+{\"controller\"=>\"application\", \"action\"=>\"route_not_found\",") + end + + failure_message do |_| + "expected #{actual} to route to route_not_found" + end +end From 4dd5333b38a514eab13209d553e93f194ce5fd71 Mon Sep 17 00:00:00 2001 From: Pirate Praveen Date: Thu, 4 Feb 2021 15:48:48 +0530 Subject: [PATCH 5/5] Upload to experimental --- debian/changelog | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/debian/changelog b/debian/changelog index 508be107c1..336eee0a4d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +gitlab (13.6.6-1) experimental; urgency=medium + + * Use gitlab-rails-console command in README.Debian + * Document how to activate a new user from rails console + * Update minimum version of ruby-attr-encrypted + * New upstream version 13.6.6 (Fixes: CVE-2021-22172, CVE-2021-22169) + + -- Pirate Praveen Thu, 04 Feb 2021 15:48:11 +0530 + gitlab (13.6.5-1) experimental; urgency=medium [ Pirate Praveen ]