Merge branch 'rs-issue-13467' into 'master'

Ensure Commit#show responds 404 instead of 500 when given an invalid ID

Closes #13467

See merge request !2823

2 files changed, 39 insertions, 2 deletions

diff --git a/app/controllers/projects/commit_controller.rb b/app/controllers/projects/commit_controller.rb
index 21f4d9f44ec..36951b91372 100644
--- a/app/controllers/projects/commit_controller.rb
+++ b/app/controllers/projects/commit_controller.rb
@@ -11,8 +11,6 @@ class Projects::CommitController < Projects::ApplicationController
   before_action :define_show_vars, only: [:show, :builds]
 
   def show
-    return git_not_found! unless @commit
-
     apply_diff_view_cookie!
 
     @line_notes = commit.notes.inline
@@ -68,6 +66,8 @@ class Projects::CommitController < Projects::ApplicationController
   end
 
   def define_show_vars
+    return git_not_found! unless commit
+
     if params[:w].to_i == 1
       @diffs = commit.diffs({ ignore_whitespace_change: true })
     else
diff --git a/spec/controllers/projects/commit_controller_spec.rb b/spec/controllers/projects/commit_controller_spec.rb
new file mode 100644
index 00000000000..438e776ec4b
--- /dev/null
+++ b/spec/controllers/projects/commit_controller_spec.rb
@@ -0,0 +1,37 @@
+require 'rails_helper'
+
+describe Projects::CommitController do
+  describe 'GET show' do
+    let(:project) { create(:project) }
+
+    before do
+      user = create(:user)
+      project.team << [user, :master]
+
+      sign_in(user)
+    end
+
+    context 'with valid id' do
+      it 'responds with 200' do
+        go id: project.commit.id
+
+        expect(response).to be_ok
+      end
+    end
+
+    context 'with invalid id' do
+      it 'responds with 404' do
+        go id: project.commit.id.reverse
+
+        expect(response).to be_not_found
+      end
+    end
+
+    def go(id:)
+      get :show,
+        namespace_id: project.namespace.to_param,
+        project_id: project.to_param,
+        id: id
+    end
+  end
+end