Add latest changes from gitlab-org/security/gitlab@15-2-stable-ee

4 files changed, 70 insertions, 0 deletions

diff --git a/app/models/project.rb b/app/models/project.rb
index 46e25564eab..ebfec34c3e1 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -2119,6 +2119,7 @@ class Project < ApplicationRecord
   end
 
   def after_import
+    repository.remove_prohibited_branches
     repository.expire_content_cache
     wiki.repository.expire_content_cache
 
diff --git a/app/models/repository.rb b/app/models/repository.rb
index 0da71d87457..9039bdf1a20 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -1168,6 +1168,16 @@ class Repository
     @cache ||= Gitlab::RepositoryCache.new(self)
   end
 
+  def remove_prohibited_branches
+    return unless exists?
+
+    prohibited_branches = raw_repository.branch_names.select { |name| name.match(/\A\h{40}\z/) }
+
+    return if prohibited_branches.blank?
+
+    prohibited_branches.each { |name| raw_repository.delete_branch(name) }
+  end
+
   private
 
   # TODO Genericize finder, later split this on finders by Ref or Oid
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 2171ee752fd..f46a1646554 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -5632,6 +5632,7 @@ RSpec.describe Project, factory_default: :keep do
     let(:import_state) { create(:import_state, project: project) }
 
     it 'runs the correct hooks' do
+      expect(project.repository).to receive(:remove_prohibited_branches)
       expect(project.repository).to receive(:expire_content_cache)
       expect(project.wiki.repository).to receive(:expire_content_cache)
       expect(import_state).to receive(:finish)
diff --git a/spec/models/repository_spec.rb b/spec/models/repository_spec.rb
index 11323c40d28..b3fbe75a526 100644
--- a/spec/models/repository_spec.rb
+++ b/spec/models/repository_spec.rb
@@ -3364,4 +3364,62 @@ RSpec.describe Repository do
       end
     end
   end
+
+  describe '#remove_prohibited_branches' do
+    let(:branch_name) { '37fd3601be4c25497a39fa2e6a206e09e759d597' }
+
+    before do
+      allow(repository.raw_repository).to receive(:branch_names).and_return([branch_name])
+    end
+
+    context 'when prohibited branch exists' do
+      it 'deletes prohibited branch' do
+        expect(repository.raw_repository).to receive(:delete_branch).with(branch_name)
+
+        repository.remove_prohibited_branches
+      end
+    end
+
+    shared_examples 'does not delete branch' do
+      it 'returns without removing the branch' do
+        expect(repository.raw_repository).not_to receive(:delete_branch)
+
+        repository.remove_prohibited_branches
+      end
+    end
+
+    context 'when branch name is 40-characters long but not hexadecimal' do
+      let(:branch_name) { '37fd3601be4c25497a39fa2e6a206e09e759d59s' }
+
+      include_examples 'does not delete branch'
+    end
+
+    context 'when branch name is hexadecimal' do
+      context 'when branch name is less than 40-characters long' do
+        let(:branch_name) { '37fd3601be4c25497a39fa2e6a206e09e759d' }
+
+        include_examples 'does not delete branch'
+      end
+
+      context 'when branch name is more than 40-characters long' do
+        let(:branch_name) { '37fd3601be4c25497a39fa2e6a206e09e759dfdfd' }
+
+        include_examples 'does not delete branch'
+      end
+    end
+
+    context 'when prohibited branch does not exist' do
+      let(:branch_name) { 'main' }
+
+      include_examples 'does not delete branch'
+    end
+
+    context 'when raw repository does not exist' do
+      before do
+        allow(repository).to receive(:exists?).and_return(false)
+      end
+
+      include_examples 'does not delete branch'
+    end
+  end
 end