diff options
author | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2022-08-22 18:59:57 +0000 |
---|---|---|
committer | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2022-08-22 18:59:57 +0000 |
commit | 99e4792893862d913d0bc9168da7d85775445590 (patch) | |
tree | 1452a6d93ec58d9f84a693ab6a97bf0474ddafba | |
parent | ffd31180c9a4198b3bbd2c34f272f30ecadfa5a7 (diff) | |
parent | 0ab7bf7ee3856eb734598672ddd647d11381dea6 (diff) | |
download | gitlab-ce-99e4792893862d913d0bc9168da7d85775445590.tar.gz |
Merge remote-tracking branch 'dev/15-1-stable' into 15-1-stable
-rw-r--r-- | CHANGELOG.md | 7 | ||||
-rw-r--r-- | GITALY_SERVER_VERSION | 2 | ||||
-rw-r--r-- | VERSION | 2 | ||||
-rw-r--r-- | lib/gitlab/cache/import/caching.rb | 21 | ||||
-rw-r--r-- | spec/features/projects_spec.rb | 2 | ||||
-rw-r--r-- | spec/lib/gitlab/cache/import/caching_spec.rb | 45 |
6 files changed, 76 insertions, 3 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 9a5bcb26dea..94cc84a7526 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,13 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 15.1.5 (2022-08-22) + +### Security (2 changes) + +- [Validate if values to be saved in Redis can be converted to string](gitlab-org/security/gitlab@0bc82f875f78b6a2703b294b1a5a8d941000f9f2) ([merge request](gitlab-org/security/gitlab!2725)) +- [Fix CSS selector used in specs](gitlab-org/security/gitlab@a900e65b192a8415baa6bcd4050566543107ab1f) ([merge request](gitlab-org/security/gitlab!2728)) + ## 15.1.4 (2022-07-28) ### Security (18 changes) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 5f456472367..086830eb8db 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -15.1.4
\ No newline at end of file +15.1.5
\ No newline at end of file @@ -1 +1 @@ -15.1.4
\ No newline at end of file +15.1.5
\ No newline at end of file diff --git a/lib/gitlab/cache/import/caching.rb b/lib/gitlab/cache/import/caching.rb index 4dbce0b05e1..4e7a7f326a5 100644 --- a/lib/gitlab/cache/import/caching.rb +++ b/lib/gitlab/cache/import/caching.rb @@ -65,6 +65,8 @@ module Gitlab # value - The value to set. # timeout - The time after which the cache key should expire. def self.write(raw_key, value, timeout: TIMEOUT) + validate_redis_value!(value) + key = cache_key_for(raw_key) Redis::Cache.with do |redis| @@ -99,6 +101,8 @@ module Gitlab # timeout - The time after which the cache key should expire. # @return - the incremented value def self.increment_by(raw_key, value, timeout: TIMEOUT) + validate_redis_value!(value) + key = cache_key_for(raw_key) Redis::Cache.with do |redis| @@ -113,6 +117,8 @@ module Gitlab # value - The value to add to the set. # timeout - The new timeout of the key. def self.set_add(raw_key, value, timeout: TIMEOUT) + validate_redis_value!(value) + key = cache_key_for(raw_key) Redis::Cache.with do |redis| @@ -128,6 +134,8 @@ module Gitlab # raw_key - The key of the set to check. # value - The value to check for. def self.set_includes?(raw_key, value) + validate_redis_value!(value) + key = cache_key_for(raw_key) Redis::Cache.with do |redis| @@ -157,6 +165,8 @@ module Gitlab mapping.each do |raw_key, value| key = cache_key_for("#{key_prefix}#{raw_key}") + validate_redis_value!(value) + multi.set(key, value, ex: timeout) end end @@ -186,6 +196,8 @@ module Gitlab # # Returns true when the key was overwritten, false otherwise. def self.write_if_greater(raw_key, value, timeout: TIMEOUT) + validate_redis_value!(value) + key = cache_key_for(raw_key) val = Redis::Cache.with do |redis| redis @@ -202,6 +214,8 @@ module Gitlab # value - The field value to add to the hash. # timeout - The new timeout of the key. def self.hash_add(raw_key, field, value, timeout: TIMEOUT) + validate_redis_value!(value) + key = cache_key_for(raw_key) Redis::Cache.with do |redis| @@ -226,6 +240,13 @@ module Gitlab def self.cache_key_for(raw_key) "#{Redis::Cache::CACHE_NAMESPACE}:#{raw_key}" end + + def self.validate_redis_value!(value) + value_as_string = value.to_s + return if value_as_string.is_a?(String) + + raise "Value '#{value_as_string}' of type '#{value_as_string.class}' for '#{value.inspect}' is not a String" + end end end end diff --git a/spec/features/projects_spec.rb b/spec/features/projects_spec.rb index db64f84aa76..9dcf3c5ab99 100644 --- a/spec/features/projects_spec.rb +++ b/spec/features/projects_spec.rb @@ -329,7 +329,7 @@ RSpec.describe 'Project' do it 'has working links to submodules' do click_link('645f6c4c') - expect(page).to have_selector('.qa-branches-select', text: '645f6c4c82fd3f5e06f67134450a570b795e55a6') # rubocop:disable QA/SelectorUsage + expect(page).to have_selector('[data-testid="branches-select"]', text: '645f6c4c82fd3f5e06f67134450a570b795e55a6') end context 'for signed commit on default branch', :js do diff --git a/spec/lib/gitlab/cache/import/caching_spec.rb b/spec/lib/gitlab/cache/import/caching_spec.rb index 946a7c604a1..6f9879da281 100644 --- a/spec/lib/gitlab/cache/import/caching_spec.rb +++ b/spec/lib/gitlab/cache/import/caching_spec.rb @@ -3,6 +3,17 @@ require 'spec_helper' RSpec.describe Gitlab::Cache::Import::Caching, :clean_gitlab_redis_cache do + shared_examples 'validated redis value' do + let(:value) { double('value', to_s: Object.new) } + + it 'raise error if value.to_s does not return a String' do + value_as_string = value.to_s + message = /Value '#{value_as_string}' of type '#{value_as_string.class}' for '#{value.inspect}' is not a String/ + + expect { subject }.to raise_error(message) + end + end + describe '.read' do it 'reads a value from the cache' do described_class.write('foo', 'bar') @@ -56,6 +67,16 @@ RSpec.describe Gitlab::Cache::Import::Caching, :clean_gitlab_redis_cache do expect(described_class.write('foo', 10)).to eq(10) expect(described_class.read('foo')).to eq('10') end + + it_behaves_like 'validated redis value' do + subject { described_class.write('foo', value) } + end + end + + describe '.increment_by' do + it_behaves_like 'validated redis value' do + subject { described_class.increment_by('foo', value) } + end end describe '.increment' do @@ -78,6 +99,10 @@ RSpec.describe Gitlab::Cache::Import::Caching, :clean_gitlab_redis_cache do expect(values).to eq(['10']) end + + it_behaves_like 'validated redis value' do + subject { described_class.set_add('foo', value) } + end end describe '.set_includes?' do @@ -96,6 +121,10 @@ RSpec.describe Gitlab::Cache::Import::Caching, :clean_gitlab_redis_cache do expect(described_class.set_includes?('foo', 10)).to eq(true) end + + it_behaves_like 'validated redis value' do + subject { described_class.set_includes?('foo', value) } + end end describe '.values_from_set' do @@ -120,6 +149,10 @@ RSpec.describe Gitlab::Cache::Import::Caching, :clean_gitlab_redis_cache do expect(values).to eq({ '1' => '1', '2' => '2' }) end + + it_behaves_like 'validated redis value' do + subject { described_class.hash_add('foo', 1, value) } + end end describe '.values_from_hash' do @@ -160,6 +193,12 @@ RSpec.describe Gitlab::Cache::Import::Caching, :clean_gitlab_redis_cache do expect(found).to eq(value.to_s) end end + + it_behaves_like 'validated redis value' do + let(:mapping) { { 'foo' => value, 'bar' => value } } + + subject { described_class.write_multiple(mapping) } + end end describe '.expire' do @@ -175,4 +214,10 @@ RSpec.describe Gitlab::Cache::Import::Caching, :clean_gitlab_redis_cache do expect(found_ttl).to be <= timeout end end + + describe '.write_if_greater' do + it_behaves_like 'validated redis value' do + subject { described_class.write_if_greater('foo', value) } + end + end end |