Merge remote-tracking branch 'origin/master' into dz-codeclimate-comparedz-codeclimate-compare

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

12 files changed, 449 insertions, 362 deletions

diff --git a/lib/api/repositories.rb b/lib/api/repositories.rb
index 8f16e532ecb..14d2bff9cb5 100644
--- a/lib/api/repositories.rb
+++ b/lib/api/repositories.rb
@@ -85,7 +85,7 @@ module API
         optional :sha, type: String, desc: 'The commit sha of the archive to be downloaded'
         optional :format, type: String, desc: 'The archive format'
       end
-      get ':id/repository/archive', requirements: { format: Gitlab::Regex.archive_formats_regex } do
+      get ':id/repository/archive', requirements: { format: Gitlab::PathRegex.archive_formats_regex } do
         begin
           send_git_archive user_project.repository, ref: params[:sha], format: params[:format]
         rescue
diff --git a/lib/api/v3/repositories.rb b/lib/api/v3/repositories.rb
index e4d14bc8168..0eaa0de2eef 100644
--- a/lib/api/v3/repositories.rb
+++ b/lib/api/v3/repositories.rb
@@ -72,7 +72,7 @@ module API
           optional :sha, type: String, desc: 'The commit sha of the archive to be downloaded'
           optional :format, type: String, desc: 'The archive format'
         end
-        get ':id/repository/archive', requirements: { format: Gitlab::Regex.archive_formats_regex } do
+        get ':id/repository/archive', requirements: { format: Gitlab::PathRegex.archive_formats_regex } do
           begin
             send_git_archive user_project.repository, ref: params[:sha], format: params[:format]
           rescue
diff --git a/lib/constraints/group_url_constrainer.rb b/lib/constraints/group_url_constrainer.rb
index 0ea2f97352d..6fc1d56d7a0 100644
--- a/lib/constraints/group_url_constrainer.rb
+++ b/lib/constraints/group_url_constrainer.rb
@@ -1,9 +1,9 @@
 class GroupUrlConstrainer
   def matches?(request)
-    id = request.params[:group_id] || request.params[:id]
+    full_path = request.params[:group_id] || request.params[:id]
 
-    return false unless DynamicPathValidator.valid_namespace_path?(id)
+    return false unless DynamicPathValidator.valid_group_path?(full_path)
 
-    Group.find_by_full_path(id, follow_redirects: request.get?).present?
+    Group.find_by_full_path(full_path, follow_redirects: request.get?).present?
   end
 end
diff --git a/lib/constraints/project_url_constrainer.rb b/lib/constraints/project_url_constrainer.rb
index 4444a1abee3..4c0aee6c48f 100644
--- a/lib/constraints/project_url_constrainer.rb
+++ b/lib/constraints/project_url_constrainer.rb
@@ -2,7 +2,7 @@ class ProjectUrlConstrainer
   def matches?(request)
     namespace_path = request.params[:namespace_id]
     project_path = request.params[:project_id] || request.params[:id]
-    full_path = namespace_path + '/' + project_path
+    full_path = [namespace_path, project_path].join('/')
 
     return false unless DynamicPathValidator.valid_project_path?(full_path)
 
diff --git a/lib/constraints/user_url_constrainer.rb b/lib/constraints/user_url_constrainer.rb
index 28159dc0dec..d16ae7f3f40 100644
--- a/lib/constraints/user_url_constrainer.rb
+++ b/lib/constraints/user_url_constrainer.rb
@@ -1,5 +1,9 @@
 class UserUrlConstrainer
   def matches?(request)
-    User.find_by_full_path(request.params[:username], follow_redirects: request.get?).present?
+    full_path = request.params[:username]
+
+    return false unless DynamicPathValidator.valid_user_path?(full_path)
+
+    User.find_by_full_path(full_path, follow_redirects: request.get?).present?
   end
 end
diff --git a/lib/gitlab/diff/file_collection/base.rb b/lib/gitlab/diff/file_collection/base.rb
index 2b9fc65b985..7c32adc6ce7 100644
--- a/lib/gitlab/diff/file_collection/base.rb
+++ b/lib/gitlab/diff/file_collection/base.rb
@@ -24,6 +24,14 @@ module Gitlab
           @diff_files ||= @diffs.decorate! { |diff| decorate_diff!(diff) }
         end
 
+        def diff_file_with_old_path(old_path)
+          diff_files.find { |diff_file| diff_file.old_path == old_path }
+        end
+
+        def diff_file_with_new_path(new_path)
+          diff_files.find { |diff_file| diff_file.new_path == new_path }
+        end
+
         private
 
         def decorate_diff!(diff)
diff --git a/lib/gitlab/diff/position.rb b/lib/gitlab/diff/position.rb
index fc728123c97..4d96778a2b2 100644
--- a/lib/gitlab/diff/position.rb
+++ b/lib/gitlab/diff/position.rb
@@ -12,20 +12,26 @@ module Gitlab
       attr_reader :head_sha
 
       def initialize(attrs = {})
+        if diff_file = attrs[:diff_file]
+          attrs[:diff_refs] = diff_file.diff_refs
+          attrs[:old_path] = diff_file.old_path
+          attrs[:new_path] = diff_file.new_path
+        end
+
+        if diff_refs = attrs[:diff_refs]
+          attrs[:base_sha]  = diff_refs.base_sha
+          attrs[:start_sha] = diff_refs.start_sha
+          attrs[:head_sha]  = diff_refs.head_sha
+        end
+
         @old_path = attrs[:old_path]
         @new_path = attrs[:new_path]
+        @base_sha  = attrs[:base_sha]
+        @start_sha = attrs[:start_sha]
+        @head_sha  = attrs[:head_sha]
+
         @old_line = attrs[:old_line]
         @new_line = attrs[:new_line]
-
-        if attrs[:diff_refs]
-          @base_sha  = attrs[:diff_refs].base_sha
-          @start_sha = attrs[:diff_refs].start_sha
-          @head_sha  = attrs[:diff_refs].head_sha
-        else
-          @base_sha  = attrs[:base_sha]
-          @start_sha = attrs[:start_sha]
-          @head_sha  = attrs[:head_sha]
-        end
       end
 
       # `Gitlab::Diff::Position` objects are stored as serialized attributes in
@@ -129,11 +135,11 @@ module Gitlab
       end
 
       def diff_line(repository)
-        @diff_line ||= diff_file(repository).line_for_position(self)
+        @diff_line ||= diff_file(repository)&.line_for_position(self)
       end
 
       def line_code(repository)
-        @line_code ||= diff_file(repository).line_code_for_position(self)
+        @line_code ||= diff_file(repository)&.line_code_for_position(self)
       end
 
       private
diff --git a/lib/gitlab/diff/position_tracer.rb b/lib/gitlab/diff/position_tracer.rb
index e89ff238ec7..dcabb5f7fe5 100644
--- a/lib/gitlab/diff/position_tracer.rb
+++ b/lib/gitlab/diff/position_tracer.rb
@@ -3,21 +3,21 @@
 module Gitlab
   module Diff
     class PositionTracer
-      attr_accessor :repository
+      attr_accessor :project
       attr_accessor :old_diff_refs
       attr_accessor :new_diff_refs
       attr_accessor :paths
 
-      def initialize(repository:, old_diff_refs:, new_diff_refs:, paths: nil)
-        @repository = repository
+      def initialize(project:, old_diff_refs:, new_diff_refs:, paths: nil)
+        @project = project
         @old_diff_refs = old_diff_refs
         @new_diff_refs = new_diff_refs
         @paths = paths
       end
 
-      def trace(old_position)
+      def trace(ab_position)
         return unless old_diff_refs&.complete? && new_diff_refs&.complete?
-        return unless old_position.diff_refs == old_diff_refs
+        return unless ab_position.diff_refs == old_diff_refs
 
         # Suppose we have an MR with source branch `feature` and target branch `master`.
         # When the MR was created, the head of `master` was commit A, and the
@@ -44,14 +44,16 @@ module Gitlab
         #
         # For diff notes for diff A->B, the position looks like this:
         # Position
-        #   base_sha - ID of commit A
+        #   start_sha - ID of commit A
         #   head_sha - ID of commit B
+        #   base_sha - ID of base commit of A and B
         #   old_path - path as of A (nil if file was newly created)
         #   new_path - path as of B (nil if file was deleted)
         #   old_line - line number as of A (nil if file was newly created)
         #   new_line - line number as of B (nil if file was deleted)
         #
-        # We can easily update `base_sha` and `head_sha` to hold the IDs of commits C and D,
+        # We can easily update `start_sha` and `head_sha` to hold the IDs of
+        # commits C and D, and can trivially determine `base_sha` based on those,
         # but need to find the paths and line numbers as of C and D.
         #
         # If the file was unchanged or newly created in A->B, the path as of D can be found
@@ -68,107 +70,161 @@ module Gitlab
         # by generating diff A->C ("base to base"), finding the diff file with
         # `diff_file.old_path == position.old_path`, and taking `diff_file.new_path`.
         # The path as of D can be found by taking diff C->D, finding the diff file
-        # with that same `old_path` and taking `diff_file.new_path`.
+        # with `old_path` set to that `diff_file.new_path` and taking `diff_file.new_path`.
         # The line number as of C can be found by using the LineMapper on diff A->C
         # and providing the line number as of A.
         # The line number as of D can be found by using the LineMapper on diff C->D
         # and providing the line number as of C.
 
-        results = nil
-        results ||= trace_added_line(old_position)   if old_position.added?   || old_position.unchanged?
-        results ||= trace_removed_line(old_position) if old_position.removed? || old_position.unchanged?
-
-        return unless results
-
-        file_diff, old_line, new_line = results
-
-        new_position = Position.new(
-          old_path: file_diff.old_path,
-          new_path: file_diff.new_path,
-          head_sha: new_diff_refs.head_sha,
-          start_sha: new_diff_refs.start_sha,
-          base_sha: new_diff_refs.base_sha,
-          old_line: old_line,
-          new_line: new_line
-        )
-
-        # If a position is found, but is not actually contained in the diff, for example
-        # because it was an unchanged line in the context of a change that was undone,
-        # we cannot return this as a successful trace.
-        return unless new_position.diff_line(repository)
-
-        new_position
+        if ab_position.added?
+          trace_added_line(ab_position)
+        elsif ab_position.removed?
+          trace_removed_line(ab_position)
+        else # unchanged
+          trace_unchanged_line(ab_position)
+        end
       end
 
       private
 
-      def trace_added_line(old_position)
-        file_path = old_position.new_path
-
-        return unless diff_head_to_head
-
-        file_head_to_head = diff_head_to_head.find { |diff_file| diff_file.old_path == file_path }
-
-        file_path = file_head_to_head.new_path if file_head_to_head
-
-        new_line = LineMapper.new(file_head_to_head).old_to_new(old_position.new_line)
-
-        return unless new_line
-
-        file_diff = new_diffs.find { |diff_file| diff_file.new_path == file_path }
-        return unless file_diff
-
-        old_line = LineMapper.new(file_diff).new_to_old(new_line)
-
-        [file_diff, old_line, new_line]
+      def trace_added_line(ab_position)
+        b_path = ab_position.new_path
+        b_line = ab_position.new_line
+
+        bd_diff = bd_diffs.diff_file_with_old_path(b_path)
+
+        d_path = bd_diff&.new_path || b_path
+        d_line = LineMapper.new(bd_diff).old_to_new(b_line)
+
+        if d_line
+          cd_diff = cd_diffs.diff_file_with_new_path(d_path)
+
+          c_path = cd_diff&.old_path || d_path
+          c_line = LineMapper.new(cd_diff).new_to_old(d_line)
+
+          if c_line
+            # If the line is still in D but also in C, it has turned from an
+            # added line into an unchanged one.
+            new_position = position(cd_diff, c_line, d_line)
+            if valid_position?(new_position)
+              # If the line is still in the MR, we don't treat this as outdated.
+              { position: new_position, outdated: false }
+            else
+              # If the line is no longer in the MR, we unfortunately cannot show
+              # the current state on the CD diff, so we treat it as outdated.
+              ac_diff = ac_diffs.diff_file_with_new_path(c_path)
+
+              { position: position(ac_diff, nil, c_line), outdated: true }
+            end
+          else
+            # If the line is still in D and not in C, it is still added.
+            { position: position(cd_diff, nil, d_line), outdated: false }
+          end
+        else
+          # If the line is no longer in D, it has been removed from the MR.
+          { position: position(bd_diff, b_line, nil), outdated: true }
+        end
       end
 
-      def trace_removed_line(old_position)
-        file_path = old_position.old_path
+      def trace_removed_line(ab_position)
+        a_path = ab_position.old_path
+        a_line = ab_position.old_line
 
-        return unless diff_base_to_base
+        ac_diff = ac_diffs.diff_file_with_old_path(a_path)
 
-        file_base_to_base = diff_base_to_base.find { |diff_file| diff_file.old_path == file_path }
+        c_path = ac_diff&.new_path || a_path
+        c_line = LineMapper.new(ac_diff).old_to_new(a_line)
 
-        file_path = file_base_to_base.old_path if file_base_to_base
+        if c_line
+          cd_diff = cd_diffs.diff_file_with_old_path(c_path)
 
-        old_line = LineMapper.new(file_base_to_base).old_to_new(old_position.old_line)
+          d_path = cd_diff&.new_path || c_path
+          d_line = LineMapper.new(cd_diff).old_to_new(c_line)
 
-        return unless old_line
+          if d_line
+            # If the line is still in C but also in D, it has turned from a
+            # removed line into an unchanged one.
+            bd_diff = bd_diffs.diff_file_with_new_path(d_path)
 
-        file_diff = new_diffs.find { |diff_file| diff_file.old_path == file_path }
-        return unless file_diff
-
-        new_line = LineMapper.new(file_diff).old_to_new(old_line)
+            { position: position(bd_diff, nil, d_line), outdated: true }
+          else
+            # If the line is still in C and not in D, it is still removed.
+            { position: position(cd_diff, c_line, nil), outdated: false }
+          end
+        else
+          # If the line is no longer in C, it has been removed outside of the MR.
+          { position: position(ac_diff, a_line, nil), outdated: true }
+        end
+      end
 
-        [file_diff, old_line, new_line]
+      def trace_unchanged_line(ab_position)
+        a_path = ab_position.old_path
+        a_line = ab_position.old_line
+        b_path = ab_position.new_path
+        b_line = ab_position.new_line
+
+        ac_diff = ac_diffs.diff_file_with_old_path(a_path)
+
+        c_path = ac_diff&.new_path || a_path
+        c_line = LineMapper.new(ac_diff).old_to_new(a_line)
+
+        bd_diff = bd_diffs.diff_file_with_old_path(b_path)
+
+        d_line = LineMapper.new(bd_diff).old_to_new(b_line)
+
+        cd_diff = cd_diffs.diff_file_with_old_path(c_path)
+
+        if c_line && d_line
+          # If the line is still in C and D, it is still unchanged.
+          new_position = position(cd_diff, c_line, d_line)
+          if valid_position?(new_position)
+            # If the line is still in the MR, we don't treat this as outdated.
+            { position: new_position, outdated: false }
+          else
+            # If the line is no longer in the MR, we unfortunately cannot show
+            # the current state on the CD diff or any change on the BD diff,
+            # so we treat it as outdated.
+            { position: nil, outdated: true }
+          end
+        elsif d_line # && !c_line
+          # If the line is still in D but no longer in C, it has turned from
+          # an unchanged line into an added one.
+          # We don't treat this as outdated since the line is still in the MR.
+          { position: position(cd_diff, nil, d_line), outdated: false }
+        else # !d_line && (c_line || !c_line)
+          # If the line is no longer in D, it has turned from an unchanged line
+          # into a removed one.
+          { position: position(bd_diff, b_line, nil), outdated: true }
+        end
       end
 
-      def diff_base_to_base
-        @diff_base_to_base ||= diff_files(old_diff_refs.base_sha || old_diff_refs.start_sha, new_diff_refs.base_sha || new_diff_refs.start_sha)
+      def ac_diffs
+        @ac_diffs ||= compare(
+          old_diff_refs.base_sha || old_diff_refs.start_sha,
+          new_diff_refs.base_sha || new_diff_refs.start_sha,
+          straight: true
+        )
       end
 
-      def diff_head_to_head
-        @diff_head_to_head ||= diff_files(old_diff_refs.head_sha, new_diff_refs.head_sha)
+      def bd_diffs
+        @bd_diffs ||= compare(old_diff_refs.head_sha, new_diff_refs.head_sha, straight: true)
       end
 
-      def new_diffs
-        @new_diffs ||= diff_files(new_diff_refs.start_sha, new_diff_refs.head_sha, use_base: true)
+      def cd_diffs
+        @cd_diffs ||= compare(new_diff_refs.start_sha, new_diff_refs.head_sha)
       end
 
-      def diff_files(start_sha, head_sha, use_base: false)
-        base_sha = self.repository.merge_base(start_sha, head_sha) || start_sha
+      def compare(start_sha, head_sha, straight: false)
+        compare = CompareService.new(project, head_sha).execute(project, start_sha, straight: straight)
+        compare.diffs(paths: paths)
+      end
 
-        diffs = self.repository.raw_repository.diff(
-          use_base ? base_sha : start_sha,
-          head_sha,
-          {},
-          *paths
-        )
+      def position(diff_file, old_line, new_line)
+        Position.new(diff_file: diff_file, old_line: old_line, new_line: new_line)
+      end
 
-        diffs.decorate! do |diff|
-          Gitlab::Diff::File.new(diff, repository: self.repository)
-        end
+      def valid_position?(position)
+        !!position.diff_line(project.repository)
       end
     end
   end
diff --git a/lib/gitlab/etag_caching/router.rb b/lib/gitlab/etag_caching/router.rb
index 2b0e19b338b..cc285162b44 100644
--- a/lib/gitlab/etag_caching/router.rb
+++ b/lib/gitlab/etag_caching/router.rb
@@ -10,7 +10,7 @@ module Gitlab
       #   - Ending in `issues/id`/realtime_changes` for the `issue_title` route
       USED_IN_ROUTES = %w[noteable issue notes issues realtime_changes
                           commit pipelines merge_requests new].freeze
-      RESERVED_WORDS = Gitlab::Regex::ILLEGAL_PROJECT_PATH_WORDS - USED_IN_ROUTES
+      RESERVED_WORDS = Gitlab::PathRegex::ILLEGAL_PROJECT_PATH_WORDS - USED_IN_ROUTES
       RESERVED_WORDS_REGEX = Regexp.union(*RESERVED_WORDS)
       ROUTES = [
         Gitlab::EtagCaching::Router::Route.new(
diff --git a/lib/gitlab/path_regex.rb b/lib/gitlab/path_regex.rb
new file mode 100644
index 00000000000..1c0abc9f7cf
--- /dev/null
+++ b/lib/gitlab/path_regex.rb
@@ -0,0 +1,264 @@
+module Gitlab
+  module PathRegex
+    extend self
+
+    # All routes that appear on the top level must be listed here.
+    # This will make sure that groups cannot be created with these names
+    # as these routes would be masked by the paths already in place.
+    #
+    # Example:
+    #   /api/api-project
+    #
+    #  the path `api` shouldn't be allowed because it would be masked by `api/*`
+    #
+    TOP_LEVEL_ROUTES = %w[
+      -
+      .well-known
+      abuse_reports
+      admin
+      all
+      api
+      assets
+      autocomplete
+      ci
+      dashboard
+      explore
+      files
+      groups
+      health_check
+      help
+      hooks
+      import
+      invites
+      issues
+      jwt
+      koding
+      member
+      merge_requests
+      new
+      notes
+      notification_settings
+      oauth
+      profile
+      projects
+      public
+      repository
+      robots.txt
+      s
+      search
+      sent_notifications
+      services
+      snippets
+      teams
+      u
+      unicorn_test
+      unsubscribes
+      uploads
+      users
+    ].freeze
+
+    # This list should contain all words following `/*namespace_id/:project_id` in
+    # routes that contain a second wildcard.
+    #
+    # Example:
+    #   /*namespace_id/:project_id/badges/*ref/build
+    #
+    # If `badges` was allowed as a project/group name, we would not be able to access the
+    # `badges` route for those projects:
+    #
+    # Consider a namespace with path `foo/bar` and a project called `badges`.
+    # The route to the build badge would then be `/foo/bar/badges/badges/master/build.svg`
+    #
+    # When accessing this path the route would be matched to the `badges` path
+    # with the following params:
+    #   - namespace_id: `foo`
+    #   - project_id: `bar`
+    #   - ref: `badges/master`
+    #
+    # Failing to find the project, this would result in a 404.
+    #
+    # By rejecting `badges` the router can _count_ on the fact that `badges` will
+    # be preceded by the `namespace/project`.
+    PROJECT_WILDCARD_ROUTES = %w[
+      badges
+      blame
+      blob
+      builds
+      commits
+      create
+      create_dir
+      edit
+      environments/folders
+      files
+      find_file
+      gitlab-lfs/objects
+      info/lfs/objects
+      new
+      preview
+      raw
+      refs
+      tree
+      update
+      wikis
+    ].freeze
+
+    # These are all the paths that follow `/groups/*id/ or `/groups/*group_id`
+    # We need to reject these because we have a `/groups/*id` page that is the same
+    # as the `/*id`.
+    #
+    # If we would allow a subgroup to be created with the name `activity` then
+    # this group would not be accessible through `/groups/parent/activity` since
+    # this would map to the activity-page of its parent.
+    GROUP_ROUTES = %w[
+      activity
+      analytics
+      audit_events
+      avatar
+      edit
+      group_members
+      hooks
+      issues
+      labels
+      ldap
+      ldap_group_links
+      merge_requests
+      milestones
+      notification_setting
+      pipeline_quota
+      projects
+      subgroups
+    ].freeze
+
+    ILLEGAL_PROJECT_PATH_WORDS = PROJECT_WILDCARD_ROUTES
+    ILLEGAL_GROUP_PATH_WORDS = (PROJECT_WILDCARD_ROUTES | GROUP_ROUTES).freeze
+
+    # The namespace regex is used in JavaScript to validate usernames in the "Register" form. However, Javascript
+    # does not support the negative lookbehind assertion (?<!) that disallows usernames ending in `.git` and `.atom`.
+    # Since this is a non-trivial problem to solve in Javascript (heavily complicate the regex, modify view code to
+    # allow non-regex validations, etc), `NAMESPACE_FORMAT_REGEX_JS` serves as a Javascript-compatible version of
+    # `NAMESPACE_FORMAT_REGEX`, with the negative lookbehind assertion removed. This means that the client-side validation
+    # will pass for usernames ending in `.atom` and `.git`, but will be caught by the server-side validation.
+    PATH_REGEX_STR = '[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*'.freeze
+    NAMESPACE_FORMAT_REGEX_JS = PATH_REGEX_STR + '[a-zA-Z0-9_\-]|[a-zA-Z0-9_]'.freeze
+
+    NO_SUFFIX_REGEX = /(?<!\.git|\.atom)/.freeze
+    NAMESPACE_FORMAT_REGEX = /(?:#{NAMESPACE_FORMAT_REGEX_JS})#{NO_SUFFIX_REGEX}/.freeze
+    PROJECT_PATH_FORMAT_REGEX = /(?:#{PATH_REGEX_STR})#{NO_SUFFIX_REGEX}/.freeze
+    FULL_NAMESPACE_FORMAT_REGEX = %r{(#{NAMESPACE_FORMAT_REGEX}/)*#{NAMESPACE_FORMAT_REGEX}}.freeze
+
+    def root_namespace_route_regex
+      @root_namespace_route_regex ||= begin
+        illegal_words = Regexp.new(Regexp.union(TOP_LEVEL_ROUTES).source, Regexp::IGNORECASE)
+
+        single_line_regexp %r{
+          (?!(#{illegal_words})/)
+          #{NAMESPACE_FORMAT_REGEX}
+        }x
+      end
+    end
+
+    def full_namespace_route_regex
+      @full_namespace_route_regex ||= begin
+        illegal_words = Regexp.new(Regexp.union(ILLEGAL_GROUP_PATH_WORDS).source, Regexp::IGNORECASE)
+
+        single_line_regexp %r{
+          #{root_namespace_route_regex}
+          (?:
+            /
+            (?!#{illegal_words}/)
+            #{NAMESPACE_FORMAT_REGEX}
+          )*
+        }x
+      end
+    end
+
+    def project_route_regex
+      @project_route_regex ||= begin
+        illegal_words = Regexp.new(Regexp.union(ILLEGAL_PROJECT_PATH_WORDS).source, Regexp::IGNORECASE)
+
+        single_line_regexp %r{
+          (?!(#{illegal_words})/)
+          #{PROJECT_PATH_FORMAT_REGEX}
+        }x
+      end
+    end
+
+    def project_git_route_regex
+      @project_git_route_regex ||= /#{project_route_regex}\.git/.freeze
+    end
+
+    def root_namespace_path_regex
+      @root_namespace_path_regex ||= %r{\A#{root_namespace_route_regex}/\z}
+    end
+
+    def full_namespace_path_regex
+      @full_namespace_path_regex ||= %r{\A#{full_namespace_route_regex}/\z}
+    end
+
+    def project_path_regex
+      @project_path_regex ||= %r{\A#{project_route_regex}/\z}
+    end
+
+    def full_project_path_regex
+      @full_project_path_regex ||= %r{\A#{full_namespace_route_regex}/#{project_route_regex}/\z}
+    end
+
+    def full_namespace_format_regex
+      @namespace_format_regex ||= /A#{FULL_NAMESPACE_FORMAT_REGEX}\z/.freeze
+    end
+
+    def namespace_format_regex
+      @namespace_format_regex ||= /\A#{NAMESPACE_FORMAT_REGEX}\z/.freeze
+    end
+
+    def namespace_format_message
+      "can contain only letters, digits, '_', '-' and '.'. " \
+      "Cannot start with '-' or end in '.', '.git' or '.atom'." \
+    end
+
+    def project_path_format_regex
+      @project_path_format_regex ||= /\A#{PROJECT_PATH_FORMAT_REGEX}\z/.freeze
+    end
+
+    def project_path_format_message
+      "can contain only letters, digits, '_', '-' and '.'. " \
+      "Cannot start with '-', end in '.git' or end in '.atom'" \
+    end
+
+    def archive_formats_regex
+      #                           |zip|tar|    tar.gz    |         tar.bz2         |
+      @archive_formats_regex ||= /(zip|tar|tar\.gz|tgz|gz|tar\.bz2|tbz|tbz2|tb2|bz2)/.freeze
+    end
+
+    def git_reference_regex
+      # Valid git ref regex, see:
+      # https://www.kernel.org/pub/software/scm/git/docs/git-check-ref-format.html
+
+      @git_reference_regex ||= single_line_regexp %r{
+        (?!
+           (?# doesn't begins with)
+           \/|                    (?# rule #6)
+           (?# doesn't contain)
+           .*(?:
+              [\/.]\.|            (?# rule #1,3)
+              \/\/|               (?# rule #6)
+              @\{|                (?# rule #8)
+              \\                  (?# rule #9)
+           )
+        )
+        [^\000-\040\177~^:?*\[]+  (?# rule #4-5)
+        (?# doesn't end with)
+        (?<!\.lock)               (?# rule #1)
+        (?<![\/.])                (?# rule #6-7)
+      }x
+    end
+
+    private
+
+    def single_line_regexp(regex)
+      # Turns a multiline extended regexp into a single line one,
+      # beacuse `rake routes` breaks on multiline regexes.
+      Regexp.new(regex.source.gsub(/\(\?#.+?\)/, '').gsub(/\s*/, ''), regex.options ^ Regexp::EXTENDED).freeze
+    end
+  end
+end
diff --git a/lib/gitlab/regex.rb b/lib/gitlab/regex.rb
index f609850f8fa..e4d2a992470 100644
--- a/lib/gitlab/regex.rb
+++ b/lib/gitlab/regex.rb
@@ -2,203 +2,6 @@ module Gitlab
   module Regex
     extend self
 
-    # All routes that appear on the top level must be listed here.
-    # This will make sure that groups cannot be created with these names
-    # as these routes would be masked by the paths already in place.
-    #
-    # Example:
-    #   /api/api-project
-    #
-    #  the path `api` shouldn't be allowed because it would be masked by `api/*`
-    #
-    TOP_LEVEL_ROUTES = %w[
-      -
-      .well-known
-      abuse_reports
-      admin
-      all
-      api
-      assets
-      autocomplete
-      ci
-      dashboard
-      explore
-      files
-      groups
-      health_check
-      help
-      hooks
-      import
-      invites
-      issues
-      jwt
-      koding
-      member
-      merge_requests
-      new
-      notes
-      notification_settings
-      oauth
-      profile
-      projects
-      public
-      repository
-      robots.txt
-      s
-      search
-      sent_notifications
-      services
-      snippets
-      teams
-      u
-      unicorn_test
-      unsubscribes
-      uploads
-      users
-    ].freeze
-
-    # This list should contain all words following `/*namespace_id/:project_id` in
-    # routes that contain a second wildcard.
-    #
-    # Example:
-    #   /*namespace_id/:project_id/badges/*ref/build
-    #
-    # If `badges` was allowed as a project/group name, we would not be able to access the
-    # `badges` route for those projects:
-    #
-    # Consider a namespace with path `foo/bar` and a project called `badges`.
-    # The route to the build badge would then be `/foo/bar/badges/badges/master/build.svg`
-    #
-    # When accessing this path the route would be matched to the `badges` path
-    # with the following params:
-    #   - namespace_id: `foo`
-    #   - project_id: `bar`
-    #   - ref: `badges/master`
-    #
-    # Failing to find the project, this would result in a 404.
-    #
-    # By rejecting `badges` the router can _count_ on the fact that `badges` will
-    # be preceded by the `namespace/project`.
-    PROJECT_WILDCARD_ROUTES = %w[
-      badges
-      blame
-      blob
-      builds
-      commits
-      create
-      create_dir
-      edit
-      environments/folders
-      files
-      find_file
-      gitlab-lfs/objects
-      info/lfs/objects
-      new
-      preview
-      raw
-      refs
-      tree
-      update
-      wikis
-    ].freeze
-
-    # These are all the paths that follow `/groups/*id/ or `/groups/*group_id`
-    # We need to reject these because we have a `/groups/*id` page that is the same
-    # as the `/*id`.
-    #
-    # If we would allow a subgroup to be created with the name `activity` then
-    # this group would not be accessible through `/groups/parent/activity` since
-    # this would map to the activity-page of its parent.
-    GROUP_ROUTES = %w[
-      activity
-      analytics
-      audit_events
-      avatar
-      edit
-      group_members
-      hooks
-      issues
-      labels
-      ldap
-      ldap_group_links
-      merge_requests
-      milestones
-      notification_setting
-      pipeline_quota
-      projects
-      subgroups
-    ].freeze
-
-    ILLEGAL_PROJECT_PATH_WORDS = PROJECT_WILDCARD_ROUTES
-    ILLEGAL_GROUP_PATH_WORDS = (PROJECT_WILDCARD_ROUTES | GROUP_ROUTES).freeze
-
-    # The namespace regex is used in Javascript to validate usernames in the "Register" form. However, Javascript
-    # does not support the negative lookbehind assertion (?<!) that disallows usernames ending in `.git` and `.atom`.
-    # Since this is a non-trivial problem to solve in Javascript (heavily complicate the regex, modify view code to
-    # allow non-regex validatiions, etc), `NAMESPACE_REGEX_STR_JS` serves as a Javascript-compatible version of
-    # `NAMESPACE_REGEX_STR`, with the negative lookbehind assertion removed. This means that the client-side validation
-    # will pass for usernames ending in `.atom` and `.git`, but will be caught by the server-side validation.
-    PATH_REGEX_STR = '[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*'.freeze
-    NAMESPACE_REGEX_STR_JS = PATH_REGEX_STR + '[a-zA-Z0-9_\-]|[a-zA-Z0-9_]'.freeze
-    NO_SUFFIX_REGEX_STR = '(?<!\.git|\.atom)'.freeze
-    NAMESPACE_REGEX_STR = "(?:#{NAMESPACE_REGEX_STR_JS})#{NO_SUFFIX_REGEX_STR}".freeze
-    PROJECT_REGEX_STR = "(?:#{PATH_REGEX_STR})#{NO_SUFFIX_REGEX_STR}".freeze
-
-    # Same as NAMESPACE_REGEX_STR but allows `/` in the path.
-    # So `group/subgroup` will match this regex but not NAMESPACE_REGEX_STR
-    FULL_NAMESPACE_REGEX_STR = "(?:#{NAMESPACE_REGEX_STR}/)*#{NAMESPACE_REGEX_STR}".freeze
-
-    def root_namespace_route_regex
-      @root_namespace_route_regex ||= begin
-        illegal_words = Regexp.new(Regexp.union(TOP_LEVEL_ROUTES).source, Regexp::IGNORECASE)
-
-        single_line_regexp %r{
-          (?!(#{illegal_words})/)
-          #{NAMESPACE_REGEX_STR}
-        }x
-      end
-    end
-
-    def root_namespace_path_regex
-      @root_namespace_path_regex ||= %r{\A#{root_namespace_route_regex}/\z}
-    end
-
-    def full_namespace_path_regex
-      @full_namespace_path_regex ||= %r{\A#{namespace_route_regex}/\z}
-    end
-
-    def full_project_path_regex
-      @full_project_path_regex ||= %r{\A#{namespace_route_regex}/#{project_route_regex}/\z}
-    end
-
-    def namespace_regex
-      @namespace_regex ||= /\A#{NAMESPACE_REGEX_STR}\z/.freeze
-    end
-
-    def full_namespace_regex
-      @full_namespace_regex ||= %r{\A#{FULL_NAMESPACE_REGEX_STR}\z}
-    end
-
-    def namespace_route_regex
-      @namespace_route_regex ||= begin
-        illegal_words = Regexp.new(Regexp.union(ILLEGAL_GROUP_PATH_WORDS).source, Regexp::IGNORECASE)
-
-        single_line_regexp %r{
-          #{root_namespace_route_regex}
-          (?:
-            /
-            (?!#{illegal_words}/)
-            #{NAMESPACE_REGEX_STR}
-          )*
-        }x
-      end
-    end
-
-    def namespace_regex_message
-      "can contain only letters, digits, '_', '-' and '.'. " \
-      "Cannot start with '-' or end in '.', '.git' or '.atom'." \
-    end
-
     def namespace_name_regex
       @namespace_name_regex ||= /\A[\p{Alnum}\p{Pd}_\. ]*\z/.freeze
     end
@@ -216,34 +19,6 @@ module Gitlab
       "It must start with letter, digit, emoji or '_'."
     end
 
-    def project_path_regex
-      @project_path_regex ||= %r{\A#{project_route_regex}/\z}
-    end
-
-    def project_route_regex
-      @project_route_regex ||= begin
-        illegal_words = Regexp.new(Regexp.union(ILLEGAL_PROJECT_PATH_WORDS).source, Regexp::IGNORECASE)
-
-        single_line_regexp %r{
-          (?!(#{illegal_words})/)
-          #{PROJECT_REGEX_STR}
-        }x
-      end
-    end
-
-    def project_git_route_regex
-      @project_git_route_regex ||= /#{project_route_regex}\.git/.freeze
-    end
-
-    def project_path_format_regex
-      @project_path_format_regex ||= /\A#{PROJECT_REGEX_STR}\z/.freeze
-    end
-
-    def project_path_regex_message
-      "can contain only letters, digits, '_', '-' and '.'. " \
-      "Cannot start with '-', end in '.git' or end in '.atom'" \
-    end
-
     def file_name_regex
       @file_name_regex ||= /\A[[[:alnum:]]_\-\.\@\+]*\z/.freeze
     end
@@ -252,36 +27,8 @@ module Gitlab
       "can contain only letters, digits, '_', '-', '@', '+' and '.'."
     end
 
-    def archive_formats_regex
-      #                           |zip|tar|    tar.gz    |         tar.bz2         |
-      @archive_formats_regex ||= /(zip|tar|tar\.gz|tgz|gz|tar\.bz2|tbz|tbz2|tb2|bz2)/.freeze
-    end
-
-    def git_reference_regex
-      # Valid git ref regex, see:
-      # https://www.kernel.org/pub/software/scm/git/docs/git-check-ref-format.html
-
-      @git_reference_regex ||= single_line_regexp %r{
-        (?!
-           (?# doesn't begins with)
-           \/|                    (?# rule #6)
-           (?# doesn't contain)
-           .*(?:
-              [\/.]\.|            (?# rule #1,3)
-              \/\/|               (?# rule #6)
-              @\{|                (?# rule #8)
-              \\                  (?# rule #9)
-           )
-        )
-        [^\000-\040\177~^:?*\[]+  (?# rule #4-5)
-        (?# doesn't end with)
-        (?<!\.lock)               (?# rule #1)
-        (?<![\/.])                (?# rule #6-7)
-      }x
-    end
-
     def container_registry_reference_regex
-      git_reference_regex
+      Gitlab::PathRegex.git_reference_regex
     end
 
     ##
@@ -315,13 +62,5 @@ module Gitlab
       "can contain only lowercase letters, digits, and '-'. " \
       "Must start with a letter, and cannot end with '-'"
     end
-
-    private
-
-    def single_line_regexp(regex)
-      # Turns a multiline extended regexp into a single line one,
-      # beacuse `rake routes` breaks on multiline regexes.
-      Regexp.new(regex.source.gsub(/\(\?#.+?\)/, '').gsub(/\s*/, ''), regex.options ^ Regexp::EXTENDED).freeze
-    end
   end
 end
diff --git a/lib/tasks/tokens.rake b/lib/tasks/tokens.rake
index 95735f43802..ad1818ff1fa 100644
--- a/lib/tasks/tokens.rake
+++ b/lib/tasks/tokens.rake
@@ -11,6 +11,11 @@ namespace :tokens do
     reset_all_users_token(:reset_incoming_email_token!)
   end
 
+  desc "Reset all GitLab RSS tokens"
+  task reset_all_rss: :environment do
+    reset_all_users_token(:reset_rss_token!)
+  end
+
   def reset_all_users_token(reset_token_method)
     TmpUser.find_in_batches do |batch|
       puts "Processing batch starting with user ID: #{batch.first.id}"
@@ -35,4 +40,9 @@ class TmpUser < ActiveRecord::Base
     write_new_token(:incoming_email_token)
     save!(validate: false)
   end
+
+  def reset_rss_token!
+    write_new_token(:rss_token)
+    save!(validate: false)
+  end
 end