From fc1cb7f6a68a93ca30e8334d071997b2c7831a64 Mon Sep 17 00:00:00 2001 From: Pirate Praveen Date: Mon, 8 May 2023 21:46:49 +0530 Subject: [PATCH] New upstream version 15.9.7+ds1 --- .gitlab-ci.yml | 17 +- .gitlab/ci/release-environments.gitlab-ci.yml | 23 + .../release-environments/main.gitlab-ci.yml | 62 ++ .gitlab/ci/rules.gitlab-ci.yml | 18 + .../merge_request_templates/Stable Branch.md | 35 ++ CHANGELOG.md | 55 ++ GITALY_SERVER_VERSION | 2 +- GITLAB_PAGES_VERSION | 2 +- Gemfile | 2 +- Gemfile.checksum | 2 +- Gemfile.lock | 4 +- VERSION | 2 +- .../markdown/render_observability.js | 45 +- .../issues/show/components/description.vue | 15 +- .../javascripts/pages/projects/project.js | 3 +- app/assets/javascripts/repository/index.js | 7 +- .../repository/utils/ref_switcher_utils.js | 27 +- .../concerns/confirm_email_warning.rb | 14 +- app/controllers/projects/blob_controller.rb | 10 + app/controllers/projects/refs_controller.rb | 2 +- app/controllers/projects/tree_controller.rb | 9 + app/controllers/projects_controller.rb | 10 +- .../environments/environment_names_finder.rb | 11 +- app/finders/notes_finder.rb | 8 + app/helpers/avatars_helper.rb | 2 +- app/models/concerns/taskable.rb | 36 +- app/models/hooks/web_hook.rb | 18 +- app/models/project_feature.rb | 3 +- app/models/uploads/fog.rb | 13 +- app/policies/project_policy.rb | 1 - app/services/ci/retry_job_service.rb | 16 +- .../set_runner_associated_projects_service.rb | 35 +- .../push_options_handler_service.rb | 10 +- .../projects/page_out_of_bounds.html.haml | 2 +- .../projects/tree/_tree_header.html.haml | 2 +- config/gitlab.yml.example | 7 +- config/initializers/1_settings.rb | 3 + danger/qa_selector/Dangerfile | 2 + danger/stable_branch_patch/Dangerfile | 4 +- danger/z_metadata/Dangerfile | 6 - db/fixtures/development/24_forks.rb | 2 +- ...0_finalize_backfill_user_details_fields.rb | 24 + ...move_temp_index_for_user_details_fields.rb | 2 - ...ify_last_error_from_project_mirror_data.rb | 26 + db/schema_migrations/20221102231130 | 1 + db/schema_migrations/20230208131808 | 1 + .../geo/replication/troubleshooting.md | 5 +- doc/development/rake_tasks.md | 2 +- doc/install/installation.md | 10 +- doc/integration/saml.md | 2 +- doc/update/background_migrations.md | 33 +- doc/update/index.md | 7 +- doc/update/upgrading_from_source.md | 8 + doc/user/group/manage.md | 71 +++ doc/user/project/issues/managing_issues.md | 8 +- doc/user/tasks.md | 10 +- .../snapshot_spec.html | 16 +- lib/api/repositories.rb | 4 + lib/banzai/filter/asset_proxy_filter.rb | 44 +- .../filter/inline_observability_filter.rb | 14 +- lib/extracts_ref.rb | 14 +- ...ify_last_error_from_project_mirror_data.rb | 17 + lib/gitlab/checks/branch_check.rb | 2 +- lib/gitlab/database/migration_helpers.rb | 4 +- lib/gitlab/git/repository.rb | 26 +- lib/gitlab/regex.rb | 58 +- lib/gitlab/unicode.rb | 6 + lib/gitlab/untrusted_regexp.rb | 11 + lib/gitlab/url_sanitizer.rb | 94 ++- lib/rouge/formatters/html_gitlab.rb | 9 +- locale/gitlab.pot | 3 + scripts/create-pipeline-failure-incident.rb | 2 - .../admin/hooks_controller_spec.rb | 3 +- .../concerns/confirm_email_warning_spec.rb | 34 +- .../projects/blob_controller_spec.rb | 33 +- .../projects/clusters_controller_spec.rb | 23 +- .../prometheus_api_controller_spec.rb | 23 +- .../projects/refs_controller_spec.rb | 2 +- .../projects/tree_controller_spec.rb | 37 +- spec/controllers/projects_controller_spec.rb | 63 ++ spec/factories/project_hooks.rb | 2 +- spec/fast_spec_helper.rb | 1 + spec/features/admin/users/user_spec.rb | 30 + .../environment_names_finder_spec.rb | 26 +- spec/finders/notes_finder_spec.rb | 20 + .../emails/valid_reply_signed_smime.eml | 588 +++++++++--------- .../markdown/render_observability_spec.js | 12 +- .../show/components/description_spec.js | 438 +++++++------ .../utils/ref_switcher_utils_spec.js | 29 +- .../mutations/ci/runner/update_spec.rb | 108 ++-- spec/helpers/avatars_helper_spec.rb | 16 +- spec/helpers/hooks_helper_spec.rb | 2 +- .../banzai/filter/asset_proxy_filter_spec.rb | 9 + .../filter/commit_trailers_filter_spec.rb | 2 +- .../inline_observability_filter_spec.rb | 52 ++ ...ast_error_from_project_mirror_data_spec.rb | 84 +++ spec/lib/gitlab/checks/branch_check_spec.rb | 8 +- spec/lib/gitlab/git/repository_spec.rb | 70 ++- spec/lib/gitlab/regex_spec.rb | 14 +- .../runner_fleet_pipeline_seeder_spec.rb | 3 +- spec/lib/gitlab/untrusted_regexp_spec.rb | 32 + spec/lib/gitlab/url_sanitizer_spec.rb | 31 +- spec/lib/rouge/formatters/html_gitlab_spec.rb | 21 +- ...alize_backfill_user_details_fields_spec.rb | 109 ++++ ...ast_error_from_project_mirror_data_spec.rb | 37 ++ spec/models/concerns/taskable_spec.rb | 22 +- .../project_error_tracking_setting_spec.rb | 2 +- spec/models/hooks/web_hook_spec.rb | 28 + ...access_level_in_projects_preloader_spec.rb | 3 +- spec/models/uploads/fog_spec.rb | 87 ++- spec/policies/project_policy_spec.rb | 50 +- spec/requests/api/repositories_spec.rb | 16 + spec/services/ci/retry_job_service_spec.rb | 15 + ...runner_associated_projects_service_spec.rb | 81 ++- .../push_options_handler_service_spec.rb | 15 + spec/services/web_hook_service_spec.rb | 4 +- spec/support/helpers/stub_object_storage.rb | 4 +- spec/tooling/danger/stable_branch_spec.rb | 120 +++- .../page_out_of_bounds.html.haml_spec.rb | 26 + tooling/danger/stable_branch.rb | 49 +- workhorse/internal/headers/content_headers.go | 32 +- .../internal/headers/content_headers_test.go | 56 ++ .../contentprocessor/contentprocessor_test.go | 4 +- workhorse/testdata/index.xhtml | 9 + workhorse/testdata/test.xml | 6 + workhorse/testdata/xml.svg | 7 + 126 files changed, 2705 insertions(+), 974 deletions(-) create mode 100644 .gitlab/ci/release-environments.gitlab-ci.yml create mode 100644 .gitlab/ci/release-environments/main.gitlab-ci.yml create mode 100644 .gitlab/merge_request_templates/Stable Branch.md create mode 100644 db/post_migrate/20221102231130_finalize_backfill_user_details_fields.rb create mode 100644 db/post_migrate/20230208131808_nullify_last_error_from_project_mirror_data.rb create mode 100644 db/schema_migrations/20221102231130 create mode 100644 db/schema_migrations/20230208131808 create mode 100644 lib/gitlab/background_migration/nullify_last_error_from_project_mirror_data.rb create mode 100644 spec/lib/gitlab/background_migration/nullify_last_error_from_project_mirror_data_spec.rb create mode 100644 spec/migrations/20221102231130_finalize_backfill_user_details_fields_spec.rb create mode 100644 spec/migrations/nullify_last_error_from_project_mirror_data_spec.rb create mode 100644 spec/views/explore/projects/page_out_of_bounds.html.haml_spec.rb create mode 100644 workhorse/internal/headers/content_headers_test.go create mode 100644 workhorse/testdata/index.xhtml create mode 100644 workhorse/testdata/test.xml create mode 100644 workhorse/testdata/xml.svg diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 9fa296be45..8b5519726d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -12,6 +12,7 @@ stages: - post-qa - pages - notify + - release-environments # always use `gitlab-org` runners, however # in cases where jobs require Docker-in-Docker, the job @@ -32,6 +33,8 @@ default: .ruby2-variables: &ruby2-variables RUBY_VERSION: "2.7" + OMNIBUS_GITLAB_RUBY2_BUILD: "true" + OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY2" .default-branch-incident-variables: &default-branch-incident-variables CREATE_INCIDENT_FOR_PIPELINE_FAILURE: "true" @@ -45,8 +48,8 @@ workflow: # If `$FORCE_GITLAB_CI` is set, create a pipeline. - if: '$FORCE_GITLAB_CI' variables: - <<: *ruby3-variables - PIPELINE_NAME: 'Ruby 3 forced pipeline' + <<: *ruby2-variables + PIPELINE_NAME: 'Ruby 2 forced pipeline' # As part of the process of creating RCs automatically, we update stable # branches with the changes of the most recent production deployment. The # merge requests used for this merge a branch release-tools/X into a stable @@ -61,14 +64,14 @@ workflow: PIPELINE_NAME: 'Ruby 2 $CI_MERGE_REQUEST_EVENT_TYPE MR pipeline' - if: '$CI_MERGE_REQUEST_LABELS =~ /Community contribution/' variables: - <<: *ruby3-variables + <<: *ruby2-variables GITLAB_DEPENDENCY_PROXY_ADDRESS: "" - PIPELINE_NAME: 'Ruby 3 $CI_MERGE_REQUEST_EVENT_TYPE MR pipeline (community contribution)' + PIPELINE_NAME: 'Ruby 2 $CI_MERGE_REQUEST_EVENT_TYPE MR pipeline (community contribution)' # For (detached) merge request pipelines. - if: '$CI_MERGE_REQUEST_IID' variables: - <<: *ruby3-variables - PIPELINE_NAME: 'Ruby 3 $CI_MERGE_REQUEST_EVENT_TYPE MR pipeline' + <<: *ruby2-variables + PIPELINE_NAME: 'Ruby 2 $CI_MERGE_REQUEST_EVENT_TYPE MR pipeline' # For the scheduled pipelines, we set specific variables. - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule"' variables: @@ -168,6 +171,7 @@ variables: ES_JAVA_OPTS: "-Xms256m -Xmx256m" ELASTIC_URL: "http://elastic:changeme@elasticsearch:9200" + BUNDLER_CHECKSUM_VERIFICATION_OPT_IN: "1" CACHE_CLASSES: "true" CHECK_PRECOMPILED_ASSETS: "true" FF_USE_FASTZIP: "true" @@ -184,6 +188,7 @@ variables: REVIEW_APPS_GCP_PROJECT: "gitlab-review-apps" REVIEW_APPS_GCP_REGION: "us-central1" + CACHE_ASSETS_AS_PACKAGE: "true" BUILD_ASSETS_IMAGE: "true" # Set it to "false" to disable assets image building, used in `build-assets-image` SIMPLECOV: "true" diff --git a/.gitlab/ci/release-environments.gitlab-ci.yml b/.gitlab/ci/release-environments.gitlab-ci.yml new file mode 100644 index 0000000000..24eca1caf4 --- /dev/null +++ b/.gitlab/ci/release-environments.gitlab-ci.yml @@ -0,0 +1,23 @@ +--- +start-release-environments-pipeline: + allow_failure: true + extends: + - .release-environments:rules:start-release-environments-pipeline + stage: release-environments + # We do not want to have ALL global variables passed as trigger variables, + # as they cannot be overridden. See this issue for more context: + # + # https://gitlab.com/gitlab-org/gitlab/-/issues/387183 + inherit: + variables: + - RUBY_VERSION + + # These variables are set in the pipeline schedules. + # They need to be explicitly passed on to the child pipeline. + # https://docs.gitlab.com/ee/ci/pipelines/multi_project_pipelines.html#pass-cicd-variables-to-a-downstream-pipeline-by-using-the-variables-keyword + variables: + # This is needed by `release-environments-build-cng-env` (`.gitlab/ci/release-environments/main.gitlab-ci.yml`). + PARENT_PIPELINE_ID: $CI_PIPELINE_ID + trigger: + strategy: depend + include: .gitlab/ci/release-environments/main.gitlab-ci.yml diff --git a/.gitlab/ci/release-environments/main.gitlab-ci.yml b/.gitlab/ci/release-environments/main.gitlab-ci.yml new file mode 100644 index 0000000000..e2fed0a6db --- /dev/null +++ b/.gitlab/ci/release-environments/main.gitlab-ci.yml @@ -0,0 +1,62 @@ +--- +default: + interruptible: true + +stages: + - prepare + +include: + - local: .gitlab/ci/global.gitlab-ci.yml + +release-environments-build-cng-env: + allow_failure: true + image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-alpine3.16 + stage: prepare + needs: + # We need this job because we need its `cached-assets-hash.txt` artifact, so that we can pass the assets image tag to the downstream CNG pipeline. + - pipeline: $PARENT_PIPELINE_ID + job: build-assets-image + variables: + BUILD_ENV: build.env + before_script: + - source ./scripts/utils.sh + - install_gitlab_gem + script: + - 'ruby -r./scripts/trigger-build.rb -e "puts Trigger.variables_for_env_file(Trigger::CNG.new.variables)" > $BUILD_ENV' + - echo "GITLAB_ASSETS_TAG=$(assets_image_tag)" >> $BUILD_ENV + - ruby -e 'puts "FULL_RUBY_VERSION=#{RUBY_VERSION}"' >> build.env + - cat $BUILD_ENV + artifacts: + reports: + dotenv: $BUILD_ENV + paths: + - $BUILD_ENV + expire_in: 7 days + when: always + +release-environments-build-cng: + allow_failure: true + stage: prepare + needs: ["release-environments-build-cng-env"] + inherit: + variables: false + variables: + GITLAB_REF_SLUG: "${GITLAB_REF_SLUG}" + # CNG pipeline specific variables + GITLAB_VERSION: "${GITLAB_VERSION}" + GITLAB_TAG: "${GITLAB_TAG}" + GITLAB_ASSETS_TAG: "${GITLAB_ASSETS_TAG}" + FORCE_RAILS_IMAGE_BUILDS: "${FORCE_RAILS_IMAGE_BUILDS}" + CE_PIPELINE: "${CE_PIPELINE}" # Based on https://docs.gitlab.com/ee/ci/jobs/job_control.html#check-if-a-variable-exists, `if: '$CE_PIPELINE'` will evaluate to `false` when this variable is empty + EE_PIPELINE: "${EE_PIPELINE}" # Based on https://docs.gitlab.com/ee/ci/jobs/job_control.html#check-if-a-variable-exists, `if: '$EE_PIPELINE'` will evaluate to `false` when this variable is empty + GITLAB_ELASTICSEARCH_INDEXER_VERSION: "${GITLAB_ELASTICSEARCH_INDEXER_VERSION}" + GITLAB_KAS_VERSION: "${GITLAB_KAS_VERSION}" + GITLAB_METRICS_EXPORTER_VERSION: "${GITLAB_METRICS_EXPORTER_VERSION}" + GITLAB_PAGES_VERSION: "${GITLAB_PAGES_VERSION}" + GITLAB_SHELL_VERSION: "${GITLAB_SHELL_VERSION}" + GITALY_SERVER_VERSION: "${GITALY_SERVER_VERSION}" + RUBY_VERSION: "${FULL_RUBY_VERSION}" + trigger: + project: gitlab-org/build/CNG-mirror + branch: $TRIGGER_BRANCH + strategy: depend diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml index d1e29084a5..2762b4e513 100644 --- a/.gitlab/ci/rules.gitlab-ci.yml +++ b/.gitlab/ci/rules.gitlab-ci.yml @@ -1901,6 +1901,13 @@ when: never - if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/' +.releases:rules:canonical-dot-com-gitlab-stable-branch-only-setup-test-env-patterns: + rules: + - if: '$CI_COMMIT_MESSAGE =~ /\[merge-train skip\]/' + when: never + - if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/' + changes: *setup-test-env-patterns + .releases:rules:canonical-dot-com-security-gitlab-stable-branch-only: rules: - if: '$CI_COMMIT_MESSAGE =~ /\[merge-train skip\]/' @@ -2295,3 +2302,14 @@ - <<: *if-dot-com-gitlab-org-merge-request changes: *feature-flag-development-config-patterns allow_failure: true # See https://gitlab.com/gitlab-org/gitlab/-/issues/351136 + +############################## +# release-environments rules # +############################## +.release-environments:rules:start-release-environments-pipeline: + rules: + - <<: *if-not-ee + when: never + - <<: *if-merge-request-labels-pipeline-expedite + when: never + - !reference [".releases:rules:canonical-dot-com-gitlab-stable-branch-only-setup-test-env-patterns", rules] diff --git a/.gitlab/merge_request_templates/Stable Branch.md b/.gitlab/merge_request_templates/Stable Branch.md new file mode 100644 index 0000000000..2196af1a21 --- /dev/null +++ b/.gitlab/merge_request_templates/Stable Branch.md @@ -0,0 +1,35 @@ + + +## What does this MR do and why? + +_Describe in detail what merge request is being backported and why_ + +## MR acceptance checklist + +This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability. + +* [ ] This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch. +* [ ] The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes). +* [ ] This MR has a [severity label] assigned (if applicable). +* [ ] Ensure the `e2e:package-and-test` job has either succeeded or been approved by a Software Engineer in Test. + +#### Note to the merge request author and maintainer + +The process of backporting bug fixes into stable branches is tracked as part of an +[internal pilot]. If you have questions about this process, please: + +* Refer to the [internal pilot] issue for feedback or questions. +* Refer to the [patch release runbook for engineers and maintainers] for guidance. + +[severity label]: https://about.gitlab.com/handbook/engineering/quality/issue-triage/#severity +[internal pilot]: https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/2886 +[patch release runbook for engineers and maintainers]: https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/patch/process_new.md + +/assign me diff --git a/CHANGELOG.md b/CHANGELOG.md index ed09742cbd..bfe402bef6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,61 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 15.9.7 (2023-05-03) + +### Security (1 change) + +- [Only maintainers of projects should be able to assign runners to them](gitlab-org/security/gitlab@695748314b758ca2d9992df7509025a6ac868000) ([merge request](gitlab-org/security/gitlab!3236)) + +## 15.9.6 (2023-05-01) + +### Security (8 changes) + +- [Resolve ambiguous references for archive metadata](gitlab-org/security/gitlab@233b0f78baf8eb9adcfd77e4d1aa606d54472d34) ([merge request](gitlab-org/security/gitlab!3203)) +- [Commit trailers now only match public user email addresses](gitlab-org/security/gitlab@e360774721bb9b5f6a2da9908ef08d92ad5a79cd) ([merge request](gitlab-org/security/gitlab!3209)) +- [Handle invalid URLs in asset proxy](gitlab-org/security/gitlab@ee6df7196b14014b5416f090a684e3b6ba600b5a) ([merge request](gitlab-org/security/gitlab!3213)) +- [Relay state to check for only allowing sub paths](gitlab-org/security/gitlab@c690eec0a2f8aa506b8ff3ffadf306aa91501648) ([merge request](gitlab-org/security/gitlab!3221)) +- [Prohibit 40 character hex sets at beginning of path-based branch name](gitlab-org/security/gitlab@889683b6b1884bfc36208dfae899d0fb9437246c) ([merge request](gitlab-org/security/gitlab!3195)) +- [Update policy to prevent banned members from accessing public projects](gitlab-org/security/gitlab@1abcbdc23881dab5f675e858afa31be87d5d47ce) ([merge request](gitlab-org/security/gitlab!3187)) +- [Use dummy filename as filename when viewing raw xml files](gitlab-org/security/gitlab@33563159bcc7d46c95f013bf089ed94128f10379) ([merge request](gitlab-org/security/gitlab!3193)) +- [Authorize access to vulnerabilitiesCountByDay resolver](gitlab-org/security/gitlab@4b0825f79b0a27eeddabaee0b3a7f627b2487706) ([merge request](gitlab-org/security/gitlab!3181)) + +## 15.9.5 (2023-04-21) + +### Fixed (1 change) + +- [Fix automatically-retried jobs stuck in pending state](gitlab-org/gitlab@752fbfcd613259b71af37f62a83321e8f573219b) ([merge request](gitlab-org/gitlab!117281)) + +## 15.9.4 (2023-03-30) + +### Security (16 changes) + +- [Add checks to remove open redirects from Observability URL](gitlab-org/security/gitlab@98b1bd243f454bd28c262131be616ee2060c3a78) ([merge request](gitlab-org/security/gitlab!3104)) +- [Redirect to tree from project root on ref collision](gitlab-org/security/gitlab@0f0c0f21dffe300a56abf1e07a2fefb17160faeb) ([merge request](gitlab-org/security/gitlab!3133)) +- [Fixes soft email confirmation alert vulnerability](gitlab-org/security/gitlab@12498f791f9c5fe833f5202b06cc818d4dcf965b) ([merge request](gitlab-org/security/gitlab!3124)) +- [Restrict Prometheus API access on public projects](gitlab-org/security/gitlab@440a7989ff46ca333f86a38aefa47f74301e66fc) ([merge request](gitlab-org/security/gitlab!3163)) +- [Verify that users have access to the parent of the fork](gitlab-org/security/gitlab@9dd0dff69d3941e827c461c67b9af10da07d69f8) ([merge request](gitlab-org/security/gitlab!3084)) +- [Protect webhook secrets by resetting url_variables](gitlab-org/security/gitlab@cd20b44dd5b075827203330802e331b896448265) ([merge request](gitlab-org/security/gitlab!3140)) +- [Replace Unicode space chars with spaces](gitlab-org/security/gitlab@76975082c41870265e1285fa8f4e053eb6ff11ae) ([merge request](gitlab-org/security/gitlab!3136)) +- [Check access to parent when creating and updating epics](gitlab-org/security/gitlab@7fcc4a0d010d3a428e803f95ef47904c4c7178a8) ([merge request](gitlab-org/security/gitlab!3149)) +- [Improve Gitlab::UrlSanitizer regex to match more URIs](gitlab-org/security/gitlab@4e7313536e4cdb3ecef37100b5a73720eabfbc79) ([merge request](gitlab-org/security/gitlab!3108)) +- [Check access to target project before looking for branch](gitlab-org/security/gitlab@f55edf39e52af9eecb19caf8ed5d4cb8524ef64d) ([merge request](gitlab-org/security/gitlab!3040)) +- [Fix the potential leak of internal notes](gitlab-org/security/gitlab@be73600e8c43c22cda1ace5910eb2052b2741972) ([merge request](gitlab-org/security/gitlab!3120)) +- [Use UntrustedRegexp to limit scan of HTML comments](gitlab-org/security/gitlab@d5e65583debcae71787e171643275bc9b9d4393e) ([merge request](gitlab-org/security/gitlab!3142)) +- [Filter namespace environments by feature visibility](gitlab-org/security/gitlab@54045b508a9ba9ae18f5992b77970240774b28a7) ([merge request](gitlab-org/security/gitlab!3111)) +- [Check access to reorder issues in epic tree](gitlab-org/security/gitlab@bc033cd3a98c9a1468545811a8180604f7f8aee3) ([merge request](gitlab-org/security/gitlab!3101)) +- [Fix security report authorization](gitlab-org/security/gitlab@a01cf9d8383ffc4c0e29514f71d49bf345e1f7c2) ([merge request](gitlab-org/security/gitlab!3106)) +- [Prevent XSS attack in "Maximum page reached" page](gitlab-org/security/gitlab@3cefb16a5e369ee99f4c3ccbaa02cead6faf1a99) ([merge request](gitlab-org/security/gitlab!3130)) + +## 15.9.3 (2023-03-09) + +### Fixed (4 changes) + +- [Fix foreign_key_exists? migration helper](gitlab-org/gitlab@7b51239b18779acfe9876fb9467f1231f56d47b4) ([merge request](gitlab-org/gitlab!114005)) +- [Enable Geo::RepositoryRegistrySyncWorker on Geo secondary site](gitlab-org/gitlab@57b542b4377bcc991b65f34a37397ac1d08846d9) ([merge request](gitlab-org/gitlab!114005)) **GitLab Enterprise Edition** +- [Guard against dropped columns when finalizing user details migration](gitlab-org/gitlab@939d646e2cbbbabf870e15fae384c0380d371111) ([merge request](gitlab-org/gitlab!114005)) +- [Fix object deletion not working with Azure Blob Storage](gitlab-org/gitlab@9515c7a334a43c0e580543029a8da5061bdc19ce) ([merge request](gitlab-org/gitlab!114005)) + ## 15.9.2 (2023-03-02) ### Security (12 changes) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 92a80da0f6..916b312da4 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -15.9.2 \ No newline at end of file +15.9.7 \ No newline at end of file diff --git a/GITLAB_PAGES_VERSION b/GITLAB_PAGES_VERSION index 92a80da0f6..916b312da4 100644 --- a/GITLAB_PAGES_VERSION +++ b/GITLAB_PAGES_VERSION @@ -1 +1 @@ -15.9.2 \ No newline at end of file +15.9.7 \ No newline at end of file diff --git a/Gemfile b/Gemfile index 9e4fd6cd3e..ed0c5127f7 100644 --- a/Gemfile +++ b/Gemfile @@ -158,7 +158,7 @@ gem 'fog-rackspace', '~> 0.1.1' # We may want to update this dependency if this is ever addressed upstream, e.g. via # https://github.com/aliyun/aliyun-oss-ruby-sdk/pull/93 gem 'fog-aliyun', '~> 0.4' -gem 'gitlab-fog-azure-rm', '~> 1.4.0', require: 'fog/azurerm' +gem 'gitlab-fog-azure-rm', '~> 1.7.0', require: 'fog/azurerm' # for Google storage gem 'google-cloud-storage', '~> 1.44.0' diff --git a/Gemfile.checksum b/Gemfile.checksum index 8e7967a81a..7813d319ee 100644 --- a/Gemfile.checksum +++ b/Gemfile.checksum @@ -202,7 +202,7 @@ {"name":"gitlab-chronic","version":"0.10.5","platform":"ruby","checksum":"f80f18dc699b708870a80685243331290bc10cfeedb6b99c92219722f729c875"}, {"name":"gitlab-dangerfiles","version":"3.7.0","platform":"ruby","checksum":"35c5bc42e60c575ab5701192ca2384ab414b14c2963602b39e143b1aaeb7e54d"}, {"name":"gitlab-experiment","version":"0.7.1","platform":"ruby","checksum":"166dddb3aa83428bcaa93c35684ed01dc4d61f321fd2ae40b020806dc54a7824"}, -{"name":"gitlab-fog-azure-rm","version":"1.4.0","platform":"ruby","checksum":"af4163c32b028aa5208814a3f4765a5817d50527e6c61931f766bf18a2e0eb7e"}, +{"name":"gitlab-fog-azure-rm","version":"1.7.0","platform":"ruby","checksum":"969c67943c54ad4c259a6acd040493f13922fbdf2211bb4eca00e71505263dc2"}, {"name":"gitlab-labkit","version":"0.30.1","platform":"ruby","checksum":"bdedbd86014c83dfd6a50d20dbc1709697bba2bb9e3666383e5f28cbd312b113"}, {"name":"gitlab-license","version":"2.2.1","platform":"ruby","checksum":"39fcf6be8b2887df8afe01b5dcbae8d08b7c5d937ff56b0fb40484a8c4f02d30"}, {"name":"gitlab-mail_room","version":"0.0.9","platform":"ruby","checksum":"6700374b5c0aa9d9ad4e711aeb677f0b7d415a6d01d3baa699efab25349d851c"}, diff --git a/Gemfile.lock b/Gemfile.lock index 2e548c469c..c988145616 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -577,7 +577,7 @@ GEM gitlab-experiment (0.7.1) activesupport (>= 3.0) request_store (>= 1.0) - gitlab-fog-azure-rm (1.4.0) + gitlab-fog-azure-rm (1.7.0) azure-storage-blob (~> 2.0) azure-storage-common (~> 2.0) fog-core (= 2.1.0) @@ -1678,7 +1678,7 @@ DEPENDENCIES gitlab-chronic (~> 0.10.5) gitlab-dangerfiles (~> 3.7.0) gitlab-experiment (~> 0.7.1) - gitlab-fog-azure-rm (~> 1.4.0) + gitlab-fog-azure-rm (~> 1.7.0) gitlab-labkit (~> 0.30.1) gitlab-license (~> 2.2.1) gitlab-mail_room (~> 0.0.9) diff --git a/VERSION b/VERSION index 92a80da0f6..916b312da4 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -15.9.2 \ No newline at end of file +15.9.7 \ No newline at end of file diff --git a/app/assets/javascripts/behaviors/markdown/render_observability.js b/app/assets/javascripts/behaviors/markdown/render_observability.js index 704d85cf22..d5d46c10ef 100644 --- a/app/assets/javascripts/behaviors/markdown/render_observability.js +++ b/app/assets/javascripts/behaviors/markdown/render_observability.js @@ -7,23 +7,36 @@ export function getFrameSrc(url) { } const mountVueComponent = (element) => { - const url = [element.dataset.frameUrl]; + const { frameUrl, observabilityUrl } = element.dataset; - return new Vue({ - el: element, - render(h) { - return h('iframe', { - style: { - height: '366px', - width: '768px', - }, - attrs: { - src: getFrameSrc(url), - frameBorder: '0', - }, - }); - }, - }); + try { + if ( + !observabilityUrl || + !frameUrl || + new URL(frameUrl)?.host !== new URL(observabilityUrl).host + ) + return; + + // eslint-disable-next-line no-new + new Vue({ + el: element, + render(h) { + return h('iframe', { + style: { + height: '366px', + width: '768px', + }, + attrs: { + src: getFrameSrc(frameUrl), + frameBorder: '0', + }, + }); + }, + }); + } catch (e) { + // eslint-disable-next-line no-console + console.error(e); + } }; export default function renderObservability(elements) { diff --git a/app/assets/javascripts/issues/show/components/description.vue b/app/assets/javascripts/issues/show/components/description.vue index 188a6f6b15..bca895bf76 100644 --- a/app/assets/javascripts/issues/show/components/description.vue +++ b/app/assets/javascripts/issues/show/components/description.vue @@ -143,7 +143,7 @@ export default { }; }, skip() { - return !this.workItemId || !this.workItemsMvcEnabled; + return !this.workItemId; }, }, workItemTypes: { @@ -156,15 +156,9 @@ export default { update(data) { return data.workspace?.workItemTypes?.nodes; }, - skip() { - return !this.workItemsMvcEnabled; - }, }, }, computed: { - workItemsMvcEnabled() { - return this.glFeatures.workItemsMvc; - }, taskWorkItemType() { return this.workItemTypes.find((type) => type.name === TASK_TYPE_NAME)?.id; }, @@ -194,8 +188,7 @@ export default { this.renderGFM(); this.updateTaskStatusText(); - - if (this.workItemId && this.workItemsMvcEnabled) { + if (this.workItemId) { const taskLink = this.$el.querySelector( `.gfm-issue[data-issue="${getIdFromGraphQLId(this.workItemId)}"]`, ); @@ -228,9 +221,7 @@ export default { this.renderSortableLists(); - if (this.workItemsMvcEnabled) { - this.renderTaskListItemActions(); - } + this.renderTaskListItemActions(); } }, renderSortableLists() { diff --git a/app/assets/javascripts/pages/projects/project.js b/app/assets/javascripts/pages/projects/project.js index 5773737c41..a4b3b83a85 100644 --- a/app/assets/javascripts/pages/projects/project.js +++ b/app/assets/javascripts/pages/projects/project.js @@ -110,9 +110,10 @@ export default class Project { const urlParams = { [fieldName]: ref }; if (params.group === BRANCH_GROUP_NAME) { urlParams.ref_type = BRANCH_REF_TYPE; - } else { + } else if (params.group === TAG_GROUP_NAME) { urlParams.ref_type = TAG_REF_TYPE; } + link.href = mergeUrlParams(urlParams, linkTarget); } diff --git a/app/assets/javascripts/repository/index.js b/app/assets/javascripts/repository/index.js index 494e270a66..95e0c94527 100644 --- a/app/assets/javascripts/repository/index.js +++ b/app/assets/javascripts/repository/index.js @@ -2,7 +2,7 @@ import { GlButton } from '@gitlab/ui'; import Vue from 'vue'; import Vuex from 'vuex'; import { parseBoolean } from '~/lib/utils/common_utils'; -import { escapeFileUrl, visitUrl } from '~/lib/utils/url_utility'; +import { joinPaths, escapeFileUrl, visitUrl } from '~/lib/utils/url_utility'; import { __ } from '~/locale'; import initWebIdeLink from '~/pages/projects/shared/web_ide_link'; import PerformancePlugin from '~/performance/vue_performance_plugin'; @@ -121,7 +121,7 @@ export default function setupVueRepositoryList() { if (!refSwitcherEl) return false; - const { projectId, projectRootPath } = refSwitcherEl.dataset; + const { projectId, projectRootPath, refType } = refSwitcherEl.dataset; return new Vue({ el: refSwitcherEl, @@ -129,7 +129,8 @@ export default function setupVueRepositoryList() { return createElement(RefSelector, { props: { projectId, - value: ref, + value: refType ? joinPaths('refs', refType, ref) : ref, + useSymbolicRefNames: true, }, on: { input(selectedRef) { diff --git a/app/assets/javascripts/repository/utils/ref_switcher_utils.js b/app/assets/javascripts/repository/utils/ref_switcher_utils.js index c62f7f709c..bcad4a2c82 100644 --- a/app/assets/javascripts/repository/utils/ref_switcher_utils.js +++ b/app/assets/javascripts/repository/utils/ref_switcher_utils.js @@ -16,22 +16,29 @@ const getNamespaceTargetRegex = (ref) => new RegExp(`(/-/(blob|tree))/${ref}/(.* * @param {string} selectedRef - The selected ref from the ref dropdown. */ export function generateRefDestinationPath(projectRootPath, ref, selectedRef) { - const currentPath = window.location.pathname; - const encodedHash = '%23'; + const url = new URL(window.location.href); + const currentPath = url.pathname; + let refType = null; let namespace = '/-/tree'; let target; + let actualRef = selectedRef; + + const matches = selectedRef.match(/^refs\/(heads|tags)\/(.+)/); + if (matches) { + [, refType, actualRef] = matches; + } + if (refType) { + url.searchParams.set('ref_type', refType); + } else { + url.searchParams.delete('ref_type'); + } + const NAMESPACE_TARGET_REGEX = getNamespaceTargetRegex(ref); const match = NAMESPACE_TARGET_REGEX.exec(currentPath); if (match) { [, namespace, , target] = match; } + url.pathname = joinPaths(projectRootPath, namespace, actualRef, target); - const destinationPath = joinPaths( - projectRootPath, - namespace, - encodeURI(selectedRef).replace(/#/g, encodedHash), - target, - ); - - return `${destinationPath}${window.location.hash}`; + return url.toString(); } diff --git a/app/controllers/concerns/confirm_email_warning.rb b/app/controllers/concerns/confirm_email_warning.rb index ec5140bf22..2711c82327 100644 --- a/app/controllers/concerns/confirm_email_warning.rb +++ b/app/controllers/concerns/confirm_email_warning.rb @@ -1,6 +1,7 @@ # frozen_string_literal: true module ConfirmEmailWarning + include Gitlab::Utils::StrongMemoize extend ActiveSupport::Concern included do @@ -17,11 +18,9 @@ module ConfirmEmailWarning return unless current_user return if current_user.confirmed? - email = current_user.unconfirmed_email || current_user.email - flash.now[:warning] = format( confirm_warning_message, - email: email, + email: email_to_display, resend_link: view_context.link_to(_('Resend it'), user_confirmation_path(user: { email: email }), method: :post), update_link: view_context.link_to(_('Update it'), profile_path) ).html_safe @@ -29,7 +28,16 @@ module ConfirmEmailWarning private + def email + current_user.unconfirmed_email || current_user.email + end + strong_memoize_attr :email + def confirm_warning_message _("Please check your email (%{email}) to verify that you own this address and unlock the power of CI/CD. Didn't receive it? %{resend_link}. Wrong email address? %{update_link}.") end + + def email_to_display + html_escape(email) + end end diff --git a/app/controllers/projects/blob_controller.rb b/app/controllers/projects/blob_controller.rb index 59cea00e26..b71af82535 100644 --- a/app/controllers/projects/blob_controller.rb +++ b/app/controllers/projects/blob_controller.rb @@ -31,6 +31,7 @@ class Projects::BlobController < Projects::ApplicationController before_action :authorize_edit_tree!, only: [:new, :create, :update, :destroy] before_action :commit, except: [:new, :create] + before_action :check_for_ambiguous_ref, only: [:show] before_action :blob, except: [:new, :create] before_action :require_branch_head, only: [:edit, :update] before_action :editor_variables, except: [:show, :preview, :diff] @@ -145,6 +146,15 @@ class Projects::BlobController < Projects::ApplicationController end end + def check_for_ambiguous_ref + @ref_type = ref_type + + if @ref_type == ExtractsRef::BRANCH_REF_TYPE && ambiguous_ref?(@project, @ref) + branch = @project.repository.find_branch(@ref) + redirect_to project_blob_path(@project, File.join(branch.target, @path)) + end + end + def commit @commit ||= @repository.commit(@ref) diff --git a/app/controllers/projects/refs_controller.rb b/app/controllers/projects/refs_controller.rb index 4c2bd2a9d4..f55fc2242a 100644 --- a/app/controllers/projects/refs_controller.rb +++ b/app/controllers/projects/refs_controller.rb @@ -22,7 +22,7 @@ class Projects::RefsController < Projects::ApplicationController when "tree" project_tree_path(@project, @id) when "blob" - project_blob_path(@project, @id) + project_blob_path(@project, @id, ref_type: ref_type) when "graph" project_network_path(@project, @id, ref_type: ref_type) when "graphs" diff --git a/app/controllers/projects/tree_controller.rb b/app/controllers/projects/tree_controller.rb index 737a629043..1f7912e15d 100644 --- a/app/controllers/projects/tree_controller.rb +++ b/app/controllers/projects/tree_controller.rb @@ -28,6 +28,15 @@ class Projects::TreeController < Projects::ApplicationController def show return render_404 unless @commit + @ref_type = ref_type + if @ref_type == BRANCH_REF_TYPE && ambiguous_ref?(@project, @ref) + branch = @project.repository.find_branch(@ref) + if branch + redirect_to project_tree_path(@project, branch.target) + return + end + end + if tree.entries.empty? if @repository.blob_at(@commit.id, @path) redirect_to project_blob_path(@project, File.join(@ref, @path)) diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 71ad747b6b..d71b782c62 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -171,11 +171,19 @@ class ProjectsController < Projects::ApplicationController flash.now[:alert] = _("Project '%{project_name}' queued for deletion.") % { project_name: @project.name } end + if ambiguous_ref?(@project, @ref) + branch = @project.repository.find_branch(@ref) + + # The files view would render a ref other than the default branch + # This redirect can be removed once the view is fixed + redirect_to(project_tree_path(@project, branch.target), alert: _("The default branch of this project clashes with another ref")) + return + end + respond_to do |format| format.html do @notification_setting = current_user.notification_settings_for(@project) if current_user @project = @project.present(current_user: current_user) - render_landing_page end diff --git a/app/finders/environments/environment_names_finder.rb b/app/finders/environments/environment_names_finder.rb index d4928f0fc8..ffb689f45e 100644 --- a/app/finders/environments/environment_names_finder.rb +++ b/app/finders/environments/environment_names_finder.rb @@ -32,18 +32,9 @@ module Environments end def namespace_environments - # We assume reporter access is needed for the :read_environment permission - # here. This expection is also present in - # IssuableFinder::Params#min_access_level, which is used for filtering out - # merge requests that don't have the right permissions. - # - # We use this approach so we don't need to load every project into memory - # just to verify if we can see their environments. Doing so would not be - # efficient, and possibly mess up pagination if certain projects are not - # meant to be visible. projects = project_or_group .all_projects - .public_or_visible_to_user(current_user, Gitlab::Access::REPORTER) + .filter_by_feature_visibility(:environments, current_user) Environment.for_project(projects) end diff --git a/app/finders/notes_finder.rb b/app/finders/notes_finder.rb index c542ffbce7..81017290f1 100644 --- a/app/finders/notes_finder.rb +++ b/app/finders/notes_finder.rb @@ -30,6 +30,7 @@ class NotesFinder notes = init_collection notes = since_fetch_at(notes) notes = notes.with_notes_filter(@params[:notes_filter]) if notes_filter? + notes = redact_internal(notes) sort(notes) end @@ -181,6 +182,13 @@ class NotesFinder notes.order_by(sort) end + + def redact_internal(notes) + subject = @project || target + return notes if Ability.allowed?(@current_user, :read_internal_note, subject) + + notes.not_internal + end end NotesFinder.prepend_mod_with('NotesFinder') diff --git a/app/helpers/avatars_helper.rb b/app/helpers/avatars_helper.rb index 0fac2cb5fc..57075a44d0 100644 --- a/app/helpers/avatars_helper.rb +++ b/app/helpers/avatars_helper.rb @@ -116,7 +116,7 @@ module AvatarsHelper private def avatar_icon_by_user_email_or_gravatar(email, size, scale, only_path:) - user = User.find_by_any_email(email) + user = User.with_public_email(email).first if user avatar_icon_for_user(user, size, scale, only_path: only_path) diff --git a/app/models/concerns/taskable.rb b/app/models/concerns/taskable.rb index f9eba4cc2f..dee1c820f2 100644 --- a/app/models/concerns/taskable.rb +++ b/app/models/concerns/taskable.rb @@ -24,25 +24,37 @@ module Taskable (\s.+) # followed by whitespace and some text. }x.freeze + ITEM_PATTERN_UNTRUSTED = + '^' \ + '(?:(?:>\s{0,4})*)' \ + '(?P(?:\s*(?:[-+*]|(?:\d+\.)))+)' \ + '\s+' \ + '(?P' \ + "#{COMPLETE_PATTERN.source}|#{INCOMPLETE_PATTERN.source}" \ + ')' \ + '(?P