use safer .hooks_for instead of .public_send

with .public_send we can't make sure that the scope on the model
actually exists.

2 files changed, 7 insertions, 1 deletions

diff --git a/app/models/concerns/triggerable_hooks.rb b/app/models/concerns/triggerable_hooks.rb
index 6e02275d552..42f40c52d29 100644
--- a/app/models/concerns/triggerable_hooks.rb
+++ b/app/models/concerns/triggerable_hooks.rb
@@ -17,6 +17,12 @@ module TriggerableHooks
   class_methods do
     attr_reader :triggerable_hooks
 
+    def hooks_for(trigger)
+      return none unless self::TRIGGERS.keys.include?(trigger)
+
+      public_send(trigger) # rubocop:disable GitlabSecurity/PublicSend
+    end
+
     private
 
     def triggerable_hooks(hooks)
diff --git a/app/models/project.rb b/app/models/project.rb
index a8c634200ce..602c6a2795f 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -970,7 +970,7 @@ class Project < ActiveRecord::Base
 
   def execute_hooks(data, hooks_scope = :push_hooks)
     run_after_commit_or_now do
-      hooks.public_send(hooks_scope).each do |hook| # rubocop:disable GitlabSecurity/PublicSend
+      hooks.hooks_for(hooks_scope).each do |hook|
         hook.async_execute(data, hooks_scope.to_s)
       end
     end