Add latest changes from gitlab-org/gitlab@master

24 files changed, 117 insertions, 994 deletions

diff --git a/lib/banzai/filter/dollar_math_pre_filter.rb b/lib/banzai/filter/dollar_math_pre_filter.rb
index aaa186f87a6..937328a2056 100644
--- a/lib/banzai/filter/dollar_math_pre_filter.rb
+++ b/lib/banzai/filter/dollar_math_pre_filter.rb
@@ -16,31 +16,30 @@ module Banzai
       # by converting it into the ```math syntax. In this way, we can ensure
       # that it's considered a code block and will not have any markdown processed inside it.
 
-      # Corresponds to the "$$\n...\n$$" syntax
-      REGEX = %r{
-          #{::Gitlab::Regex.markdown_code_or_html_blocks}
-        |
-          (?=(?<=^\n|\A)\$\$\ *\n.*\n\$\$\ *(?=\n$|\z))(?:
-            # Display math block:
-            # $$
-            # latex math
-            # $$
-
-            (?<=^\n|\A)\$\$\ *\n
-            (?<display_math>
-              (?:.)+?
-            )
-            \n\$\$\ *(?=\n$|\z)
-          )
-      }mx.freeze
+      # Display math block:
+      # $$
+      # latex math
+      # $$
+      REGEX =
+        "#{::Gitlab::Regex.markdown_code_or_html_blocks_or_html_comments_untrusted}" \
+        '|' \
+        '^\$\$\ *\n' \
+        '(?P<display_math>' \
+        '(?:\n|.)*?' \
+        ')' \
+        '\n\$\$\ *$' \
+        .freeze
 
       def call
-        @text.gsub(REGEX) do
-          if $~[:display_math]
-            # change from $$ to ```math
-            "```math\n#{$~[:display_math]}\n```"
+        regex = Gitlab::UntrustedRegexp.new(REGEX, multiline: true)
+        return @text unless regex.match?(@text)
+
+        regex.replace_gsub(@text) do |match|
+          # change from $$ to ```math
+          if match[:display_math]
+            "```math\n#{match[:display_math]}\n```"
           else
-            $~[0]
+            match.to_s
           end
         end
       end
diff --git a/lib/gitlab/database/migration_helpers/convert_to_bigint.rb b/lib/gitlab/database/migration_helpers/convert_to_bigint.rb
index cf5640deb3d..63928d7dc09 100644
--- a/lib/gitlab/database/migration_helpers/convert_to_bigint.rb
+++ b/lib/gitlab/database/migration_helpers/convert_to_bigint.rb
@@ -11,7 +11,9 @@ module Gitlab
         #
         # Once we are done with the PK conversions we can remove this.
         def com_or_dev_or_test_but_not_jh?
-          !Gitlab.jh? && (Gitlab.com? || Gitlab.dev_or_test_env?)
+          return true if Gitlab.dev_or_test_env?
+
+          Gitlab.com? && !Gitlab.jh?
         end
       end
     end
diff --git a/lib/gitlab/email/html_parser.rb b/lib/gitlab/email/html_parser.rb
index 10dbedbb464..693048adabf 100644
--- a/lib/gitlab/email/html_parser.rb
+++ b/lib/gitlab/email/html_parser.rb
@@ -34,11 +34,7 @@ module Gitlab
       end
 
       def filtered_text
-        @filtered_text ||= if Feature.enabled?(:service_desk_html_to_text_email_handler)
-                             ::Gitlab::Email::HtmlToMarkdownParser.convert(filtered_html)
-                           else
-                             Html2Text.convert(filtered_html)
-                           end
+        @filtered_text ||= ::Gitlab::Email::HtmlToMarkdownParser.convert(filtered_html)
       end
     end
   end
diff --git a/lib/gitlab/hook_data/base_builder.rb b/lib/gitlab/hook_data/base_builder.rb
index e5bae61ae4e..4a81f6b8a0e 100644
--- a/lib/gitlab/hook_data/base_builder.rb
+++ b/lib/gitlab/hook_data/base_builder.rb
@@ -5,15 +5,14 @@ module Gitlab
     class BaseBuilder
       attr_accessor :object
 
-      MARKDOWN_SIMPLE_IMAGE = %r{
-          #{::Gitlab::Regex.markdown_code_or_html_blocks}
-        |
-          (?<image>
-            !
-            \[(?<title>[^\n]*?)\]
-            \((?<url>(?!(https?://|//))[^\n]+?)\)
-          )
-      }mx.freeze
+      MARKDOWN_SIMPLE_IMAGE =
+        "#{::Gitlab::Regex.markdown_code_or_html_blocks_untrusted}" \
+        '|' \
+        '(?P<image>' \
+        '!' \
+        '\[(?P<title>[^\n]*?)\]' \
+        '\((?P<url>(?P<https>(https?://|//)?)[^\n]+?)\)' \
+        ')'.freeze
 
       def initialize(object)
         @object = object
@@ -37,15 +36,18 @@ module Gitlab
       def absolute_image_urls(markdown_text)
         return markdown_text unless markdown_text.present?
 
-        markdown_text.gsub(MARKDOWN_SIMPLE_IMAGE) do
-          if $~[:image]
-            url = $~[:url]
+        regex = Gitlab::UntrustedRegexp.new(MARKDOWN_SIMPLE_IMAGE, multiline: false)
+        return markdown_text unless regex.match?(markdown_text)
+
+        regex.replace_gsub(markdown_text) do |match|
+          if match[:image] && !match[:https]
+            url = match[:url]
             url = "#{uploads_prefix}#{url}" if url.start_with?('/uploads')
             url = "/#{url}" unless url.start_with?('/')
 
-            "![#{$~[:title]}](#{Gitlab.config.gitlab.url}#{url})"
+            "![#{match[:title]}](#{Gitlab.config.gitlab.url}#{url})"
           else
-            $~[0]
+            match.to_s
           end
         end
       end
diff --git a/lib/gitlab/kubernetes/helm/api.rb b/lib/gitlab/kubernetes/helm/api.rb
deleted file mode 100644
index ceda18442d6..00000000000
--- a/lib/gitlab/kubernetes/helm/api.rb
+++ /dev/null
@@ -1,126 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      class API
-        def initialize(kubeclient)
-          @kubeclient = kubeclient
-          @namespace = Gitlab::Kubernetes::Namespace.new(
-            Gitlab::Kubernetes::Helm::NAMESPACE,
-            kubeclient,
-            labels: Gitlab::Kubernetes::Helm::NAMESPACE_LABELS
-          )
-        end
-
-        def install(command)
-          namespace.ensure_exists!
-
-          create_service_account(command)
-          create_cluster_role_binding(command)
-          create_config_map(command)
-
-          delete_pod!(command.pod_name)
-          kubeclient.create_pod(command.pod_resource)
-        end
-
-        alias_method :update, :install
-
-        def uninstall(command)
-          namespace.ensure_exists!
-          create_config_map(command)
-
-          delete_pod!(command.pod_name)
-          kubeclient.create_pod(command.pod_resource)
-        end
-
-        ##
-        # Returns Pod phase
-        #
-        # https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase
-        #
-        # values: "Pending", "Running", "Succeeded", "Failed", "Unknown"
-        #
-        def status(pod_name)
-          kubeclient.get_pod(pod_name, namespace.name).status.phase
-        end
-
-        def log(pod_name)
-          kubeclient.get_pod_log(pod_name, namespace.name).body
-        end
-
-        def delete_pod!(pod_name)
-          kubeclient.delete_pod(pod_name, namespace.name)
-        rescue ::Kubeclient::ResourceNotFoundError
-          # no-op
-        end
-
-        def get_config_map(config_map_name)
-          namespace.ensure_exists!
-
-          kubeclient.get_config_map(config_map_name, namespace.name)
-        end
-
-        private
-
-        attr_reader :kubeclient, :namespace
-
-        def create_config_map(command)
-          command.config_map_resource.tap do |config_map_resource|
-            break unless config_map_resource
-
-            if config_map_exists?(config_map_resource)
-              kubeclient.update_config_map(config_map_resource)
-            else
-              kubeclient.create_config_map(config_map_resource)
-            end
-          end
-        end
-
-        def update_config_map(command)
-          command.config_map_resource.tap do |config_map_resource|
-            kubeclient.update_config_map(config_map_resource)
-          end
-        end
-
-        def create_service_account(command)
-          command.service_account_resource.tap do |service_account_resource|
-            break unless service_account_resource
-
-            if service_account_exists?(service_account_resource)
-              kubeclient.update_service_account(service_account_resource)
-            else
-              kubeclient.create_service_account(service_account_resource)
-            end
-          end
-        end
-
-        def create_cluster_role_binding(command)
-          command.cluster_role_binding_resource.tap do |cluster_role_binding_resource|
-            break unless cluster_role_binding_resource
-
-            kubeclient.update_cluster_role_binding(cluster_role_binding_resource)
-          end
-        end
-
-        def config_map_exists?(resource)
-          kubeclient.get_config_map(resource.metadata.name, resource.metadata.namespace)
-        rescue ::Kubeclient::ResourceNotFoundError
-          false
-        end
-
-        def service_account_exists?(resource)
-          kubeclient.get_service_account(resource.metadata.name, resource.metadata.namespace)
-        rescue ::Kubeclient::ResourceNotFoundError
-          false
-        end
-
-        def cluster_role_binding_exists?(resource)
-          kubeclient.get_cluster_role_binding(resource.metadata.name)
-        rescue ::Kubeclient::ResourceNotFoundError
-          false
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/pod.rb b/lib/gitlab/kubernetes/helm/pod.rb
deleted file mode 100644
index 9d0207e6b1f..00000000000
--- a/lib/gitlab/kubernetes/helm/pod.rb
+++ /dev/null
@@ -1,82 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      class Pod
-        def initialize(command, namespace_name, service_account_name: nil)
-          @command = command
-          @namespace_name = namespace_name
-          @service_account_name = service_account_name
-        end
-
-        def generate
-          spec = { containers: [container_specification], restartPolicy: 'Never' }
-
-          spec[:volumes] = volumes_specification
-          spec[:containers][0][:volumeMounts] = volume_mounts_specification
-          spec[:serviceAccountName] = service_account_name if service_account_name
-
-          ::Kubeclient::Resource.new(metadata: metadata, spec: spec)
-        end
-
-        private
-
-        attr_reader :command, :namespace_name, :service_account_name
-
-        def container_specification
-          {
-            name: 'helm',
-            image: "registry.gitlab.com/gitlab-org/cluster-integration/helm-install-image/releases/#{command.class::HELM_VERSION}-kube-#{Gitlab::Kubernetes::Helm::KUBECTL_VERSION}-alpine-3.12",
-            env: generate_pod_env(command),
-            command: %w(/bin/sh),
-            args: %w(-c $(COMMAND_SCRIPT))
-          }
-        end
-
-        def labels
-          {
-            'gitlab.org/action': 'install',
-            'gitlab.org/application': command.name
-          }
-        end
-
-        def metadata
-          {
-            name: command.pod_name,
-            namespace: namespace_name,
-            labels: labels
-          }
-        end
-
-        def generate_pod_env(command)
-          command.env.merge(
-            HELM_VERSION: command.class::HELM_VERSION,
-            COMMAND_SCRIPT: command.generate_script
-          ).map { |key, value| { name: key, value: value } }
-        end
-
-        def volumes_specification
-          [
-            {
-              name: 'configuration-volume',
-              configMap: {
-                name: "values-content-configuration-#{command.name}",
-                items: command.file_names.map { |name| { key: name, path: name } }
-              }
-            }
-          ]
-        end
-
-        def volume_mounts_specification
-          [
-            {
-              name: 'configuration-volume',
-              mountPath: "/data/helm/#{command.name}/config"
-            }
-          ]
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/base_command.rb b/lib/gitlab/kubernetes/helm/v2/base_command.rb
deleted file mode 100644
index 26c77b2149e..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/base_command.rb
+++ /dev/null
@@ -1,93 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        class BaseCommand
-          attr_reader :name, :files
-
-          HELM_VERSION = '2.17.0'
-
-          def initialize(rbac:, name:, files:)
-            @rbac = rbac
-            @name = name
-            @files = files
-          end
-
-          def env
-            { TILLER_NAMESPACE: namespace }
-          end
-
-          def rbac?
-            @rbac
-          end
-
-          def pod_resource
-            pod_service_account_name = rbac? ? service_account_name : nil
-
-            Gitlab::Kubernetes::Helm::Pod.new(self, namespace, service_account_name: pod_service_account_name).generate
-          end
-
-          def generate_script
-            <<~HEREDOC
-              set -xeo pipefail
-            HEREDOC
-          end
-
-          def pod_name
-            "install-#{name}"
-          end
-
-          def config_map_resource
-            Gitlab::Kubernetes::ConfigMap.new(name, files).generate
-          end
-
-          def service_account_resource
-            return unless rbac?
-
-            Gitlab::Kubernetes::ServiceAccount.new(service_account_name, namespace).generate
-          end
-
-          def cluster_role_binding_resource
-            return unless rbac?
-
-            subjects = [{ kind: 'ServiceAccount', name: service_account_name, namespace: namespace }]
-
-            Gitlab::Kubernetes::ClusterRoleBinding.new(
-              cluster_role_binding_name,
-              cluster_role_name,
-              subjects
-            ).generate
-          end
-
-          def file_names
-            files.keys
-          end
-
-          private
-
-          def files_dir
-            "/data/helm/#{name}/config"
-          end
-
-          def namespace
-            Gitlab::Kubernetes::Helm::NAMESPACE
-          end
-
-          def service_account_name
-            Gitlab::Kubernetes::Helm::SERVICE_ACCOUNT
-          end
-
-          def cluster_role_binding_name
-            Gitlab::Kubernetes::Helm::CLUSTER_ROLE_BINDING
-          end
-
-          def cluster_role_name
-            Gitlab::Kubernetes::Helm::CLUSTER_ROLE
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/certificate.rb b/lib/gitlab/kubernetes/helm/v2/certificate.rb
deleted file mode 100644
index 17ea2eb5188..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/certificate.rb
+++ /dev/null
@@ -1,75 +0,0 @@
-# frozen_string_literal: true
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        class Certificate
-          INFINITE_EXPIRY = 1000.years
-          SHORT_EXPIRY = 30.minutes
-
-          attr_reader :key, :cert
-
-          def key_string
-            @key.to_s
-          end
-
-          def cert_string
-            @cert.to_pem
-          end
-
-          def self.from_strings(key_string, cert_string)
-            key = OpenSSL::PKey::RSA.new(key_string)
-            cert = OpenSSL::X509::Certificate.new(cert_string)
-            new(key, cert)
-          end
-
-          def self.generate_root
-            _issue(signed_by: nil, expires_in: INFINITE_EXPIRY, certificate_authority: true)
-          end
-
-          def issue(expires_in: SHORT_EXPIRY)
-            self.class._issue(signed_by: self, expires_in: expires_in, certificate_authority: false)
-          end
-
-          private
-
-          def self._issue(signed_by:, expires_in:, certificate_authority:)
-            key = OpenSSL::PKey::RSA.new(4096)
-            public_key = key.public_key
-
-            subject = OpenSSL::X509::Name.parse("/C=US")
-
-            cert = OpenSSL::X509::Certificate.new
-            cert.subject = subject
-
-            cert.issuer = signed_by&.cert&.subject || subject
-
-            cert.not_before = Time.now.utc
-            cert.not_after = expires_in.from_now.utc
-            cert.public_key = public_key
-            cert.serial = 0x0
-            cert.version = 2
-
-            if certificate_authority
-              extension_factory = OpenSSL::X509::ExtensionFactory.new
-              extension_factory.subject_certificate = cert
-              extension_factory.issuer_certificate = cert
-              cert.add_extension(extension_factory.create_extension('subjectKeyIdentifier', 'hash'))
-              cert.add_extension(extension_factory.create_extension('basicConstraints', 'CA:TRUE', true))
-              cert.add_extension(extension_factory.create_extension('keyUsage', 'cRLSign,keyCertSign', true))
-            end
-
-            cert.sign(signed_by&.key || key, OpenSSL::Digest.new('SHA256'))
-
-            new(key, cert)
-          end
-
-          def initialize(key, cert)
-            @key = key
-            @cert = cert
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/client_command.rb b/lib/gitlab/kubernetes/helm/v2/client_command.rb
deleted file mode 100644
index 8b15af9aeea..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/client_command.rb
+++ /dev/null
@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        module ClientCommand
-          def init_command
-            <<~SHELL.chomp
-              export HELM_HOST="localhost:44134"
-              tiller -listen ${HELM_HOST} -alsologtostderr &
-              helm init --client-only
-            SHELL
-          end
-
-          def repository_command
-            ['helm', 'repo', 'add', name, repository].shelljoin if repository
-          end
-
-          private
-
-          def repository_update_command
-            'helm repo update'
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/delete_command.rb b/lib/gitlab/kubernetes/helm/v2/delete_command.rb
deleted file mode 100644
index 4d52fc1398f..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/delete_command.rb
+++ /dev/null
@@ -1,38 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        class DeleteCommand < BaseCommand
-          include ClientCommand
-
-          attr_reader :predelete, :postdelete
-
-          def initialize(predelete: nil, postdelete: nil, **args)
-            super(**args)
-            @predelete = predelete
-            @postdelete = postdelete
-          end
-
-          def generate_script
-            super + [
-              init_command,
-              predelete,
-              delete_command,
-              postdelete
-            ].compact.join("\n")
-          end
-
-          def pod_name
-            "uninstall-#{name}"
-          end
-
-          def delete_command
-            ['helm', 'delete', '--purge', name].shelljoin
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/init_command.rb b/lib/gitlab/kubernetes/helm/v2/init_command.rb
deleted file mode 100644
index f8b52feb5b6..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/init_command.rb
+++ /dev/null
@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        class InitCommand < BaseCommand
-          def generate_script
-            super + [
-              init_helm_command
-            ].join("\n")
-          end
-
-          private
-
-          def init_helm_command
-            command = %w[helm init] + init_command_flags
-
-            command.shelljoin
-          end
-
-          def init_command_flags
-            tls_flags + optional_service_account_flag
-          end
-
-          def tls_flags
-            [
-              '--tiller-tls',
-              '--tiller-tls-verify',
-              '--tls-ca-cert', "#{files_dir}/ca.pem",
-              '--tiller-tls-cert', "#{files_dir}/cert.pem",
-              '--tiller-tls-key', "#{files_dir}/key.pem"
-            ]
-          end
-
-          def optional_service_account_flag
-            return [] unless rbac?
-
-            ['--service-account', service_account_name]
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/install_command.rb b/lib/gitlab/kubernetes/helm/v2/install_command.rb
deleted file mode 100644
index c50db6bf177..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/install_command.rb
+++ /dev/null
@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        class InstallCommand < BaseCommand
-          include ClientCommand
-
-          attr_reader :chart, :repository, :preinstall, :postinstall
-          attr_accessor :version
-
-          def initialize(chart:, version: nil, repository: nil, preinstall: nil, postinstall: nil, **args)
-            super(**args)
-            @chart = chart
-            @version = version
-            @repository = repository
-            @preinstall = preinstall
-            @postinstall = postinstall
-          end
-
-          def generate_script
-            super + [
-              init_command,
-              repository_command,
-              repository_update_command,
-              preinstall,
-              install_command,
-              postinstall
-            ].compact.join("\n")
-          end
-
-          private
-
-          # Uses `helm upgrade --install` which means we can use this for both
-          # installation and uprade of applications
-          def install_command
-            command = ['helm', 'upgrade', name, chart] +
-              install_flag +
-              rollback_support_flag +
-              reset_values_flag +
-              optional_version_flag +
-              rbac_create_flag +
-              namespace_flag +
-              value_flag
-
-            command.shelljoin
-          end
-
-          def install_flag
-            ['--install']
-          end
-
-          def reset_values_flag
-            ['--reset-values']
-          end
-
-          def value_flag
-            ['-f', "/data/helm/#{name}/config/values.yaml"]
-          end
-
-          def namespace_flag
-            ['--namespace', Gitlab::Kubernetes::Helm::NAMESPACE]
-          end
-
-          def rbac_create_flag
-            if rbac?
-              %w[--set rbac.create=true,rbac.enabled=true]
-            else
-              %w[--set rbac.create=false,rbac.enabled=false]
-            end
-          end
-
-          def optional_version_flag
-            return [] unless version
-
-            ['--version', version]
-          end
-
-          def rollback_support_flag
-            ['--atomic', '--cleanup-on-fail']
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/patch_command.rb b/lib/gitlab/kubernetes/helm/v2/patch_command.rb
deleted file mode 100644
index 40e56771e47..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/patch_command.rb
+++ /dev/null
@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-# PatchCommand is for updating values in installed charts without overwriting
-# existing values.
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        class PatchCommand < BaseCommand
-          include ClientCommand
-
-          attr_reader :chart, :repository
-          attr_accessor :version
-
-          def initialize(chart:, version:, repository: nil, **args)
-            super(**args)
-
-            # version is mandatory to prevent chart mismatches
-            # we do not want our values interpreted in the context of the wrong version
-            raise ArgumentError, 'version is required' if version.blank?
-
-            @chart = chart
-            @version = version
-            @repository = repository
-          end
-
-          def generate_script
-            super + [
-              init_command,
-              repository_command,
-              repository_update_command,
-              upgrade_command
-            ].compact.join("\n")
-          end
-
-          private
-
-          def upgrade_command
-            command = ['helm', 'upgrade', name, chart] +
-              reuse_values_flag +
-              version_flag +
-              namespace_flag +
-              value_flag
-
-            command.shelljoin
-          end
-
-          def reuse_values_flag
-            ['--reuse-values']
-          end
-
-          def value_flag
-            ['-f', "/data/helm/#{name}/config/values.yaml"]
-          end
-
-          def namespace_flag
-            ['--namespace', Gitlab::Kubernetes::Helm::NAMESPACE]
-          end
-
-          def version_flag
-            ['--version', version]
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v2/reset_command.rb b/lib/gitlab/kubernetes/helm/v2/reset_command.rb
deleted file mode 100644
index 00626501a9a..00000000000
--- a/lib/gitlab/kubernetes/helm/v2/reset_command.rb
+++ /dev/null
@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V2
-        class ResetCommand < BaseCommand
-          include ClientCommand
-
-          def generate_script
-            super + [
-              init_command,
-              reset_helm_command
-            ].join("\n")
-          end
-
-          def pod_name
-            "uninstall-#{name}"
-          end
-
-          private
-
-          def reset_helm_command
-            'helm reset --force'
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v3/base_command.rb b/lib/gitlab/kubernetes/helm/v3/base_command.rb
deleted file mode 100644
index ca1bf5462f0..00000000000
--- a/lib/gitlab/kubernetes/helm/v3/base_command.rb
+++ /dev/null
@@ -1,101 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V3
-        class BaseCommand
-          attr_reader :name, :files
-
-          HELM_VERSION = '3.2.4'
-
-          def initialize(rbac:, name:, files:)
-            @rbac = rbac
-            @name = name
-            @files = files
-          end
-
-          def env
-            {}
-          end
-
-          def rbac?
-            @rbac
-          end
-
-          def pod_resource
-            pod_service_account_name = rbac? ? service_account_name : nil
-
-            Gitlab::Kubernetes::Helm::Pod.new(self, namespace, service_account_name: pod_service_account_name).generate
-          end
-
-          def generate_script
-            <<~HEREDOC
-              set -xeo pipefail
-            HEREDOC
-          end
-
-          def pod_name
-            "install-#{name}"
-          end
-
-          def config_map_resource
-            Gitlab::Kubernetes::ConfigMap.new(name, files).generate
-          end
-
-          def service_account_resource
-            return unless rbac?
-
-            Gitlab::Kubernetes::ServiceAccount.new(service_account_name, namespace).generate
-          end
-
-          def cluster_role_binding_resource
-            return unless rbac?
-
-            subjects = [{ kind: 'ServiceAccount', name: service_account_name, namespace: namespace }]
-
-            Gitlab::Kubernetes::ClusterRoleBinding.new(
-              cluster_role_binding_name,
-              cluster_role_name,
-              subjects
-            ).generate
-          end
-
-          def file_names
-            files.keys
-          end
-
-          def repository_command
-            ['helm', 'repo', 'add', name, repository].shelljoin if repository
-          end
-
-          private
-
-          def repository_update_command
-            'helm repo update'
-          end
-
-          def namespace_flag
-            ['--namespace', Gitlab::Kubernetes::Helm::NAMESPACE]
-          end
-
-          def namespace
-            Gitlab::Kubernetes::Helm::NAMESPACE
-          end
-
-          def service_account_name
-            Gitlab::Kubernetes::Helm::SERVICE_ACCOUNT
-          end
-
-          def cluster_role_binding_name
-            Gitlab::Kubernetes::Helm::CLUSTER_ROLE_BINDING
-          end
-
-          def cluster_role_name
-            Gitlab::Kubernetes::Helm::CLUSTER_ROLE
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v3/delete_command.rb b/lib/gitlab/kubernetes/helm/v3/delete_command.rb
deleted file mode 100644
index f628e852f54..00000000000
--- a/lib/gitlab/kubernetes/helm/v3/delete_command.rb
+++ /dev/null
@@ -1,35 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V3
-        class DeleteCommand < BaseCommand
-          attr_reader :predelete, :postdelete
-
-          def initialize(predelete: nil, postdelete: nil, **args)
-            super(**args)
-            @predelete = predelete
-            @postdelete = postdelete
-          end
-
-          def generate_script
-            super + [
-              predelete,
-              delete_command,
-              postdelete
-            ].compact.join("\n")
-          end
-
-          def pod_name
-            "uninstall-#{name}"
-          end
-
-          def delete_command
-            ['helm', 'uninstall', name, *namespace_flag].shelljoin
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v3/install_command.rb b/lib/gitlab/kubernetes/helm/v3/install_command.rb
deleted file mode 100644
index 8d521f0dcd4..00000000000
--- a/lib/gitlab/kubernetes/helm/v3/install_command.rb
+++ /dev/null
@@ -1,80 +0,0 @@
-# frozen_string_literal: true
-
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V3
-        class InstallCommand < BaseCommand
-          attr_reader :chart, :repository, :preinstall, :postinstall
-          attr_accessor :version
-
-          def initialize(chart:, version: nil, repository: nil, preinstall: nil, postinstall: nil, **args)
-            super(**args)
-            @chart = chart
-            @version = version
-            @repository = repository
-            @preinstall = preinstall
-            @postinstall = postinstall
-          end
-
-          def generate_script
-            super + [
-              repository_command,
-              repository_update_command,
-              preinstall,
-              install_command,
-              postinstall
-            ].compact.join("\n")
-          end
-
-          private
-
-          # Uses `helm upgrade --install` which means we can use this for both
-          # installation and uprade of applications
-          def install_command
-            command = ['helm', 'upgrade', name, chart] +
-              install_flag +
-              rollback_support_flag +
-              reset_values_flag +
-              optional_version_flag +
-              rbac_create_flag +
-              namespace_flag +
-              value_flag
-
-            command.shelljoin
-          end
-
-          def install_flag
-            ['--install']
-          end
-
-          def reset_values_flag
-            ['--reset-values']
-          end
-
-          def value_flag
-            ['-f', "/data/helm/#{name}/config/values.yaml"]
-          end
-
-          def rbac_create_flag
-            if rbac?
-              %w[--set rbac.create=true,rbac.enabled=true]
-            else
-              %w[--set rbac.create=false,rbac.enabled=false]
-            end
-          end
-
-          def optional_version_flag
-            return [] unless version
-
-            ['--version', version]
-          end
-
-          def rollback_support_flag
-            ['--atomic', '--cleanup-on-fail']
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/kubernetes/helm/v3/patch_command.rb b/lib/gitlab/kubernetes/helm/v3/patch_command.rb
deleted file mode 100644
index 1278e524bd2..00000000000
--- a/lib/gitlab/kubernetes/helm/v3/patch_command.rb
+++ /dev/null
@@ -1,60 +0,0 @@
-# frozen_string_literal: true
-
-# PatchCommand is for updating values in installed charts without overwriting
-# existing values.
-module Gitlab
-  module Kubernetes
-    module Helm
-      module V3
-        class PatchCommand < BaseCommand
-          attr_reader :chart, :repository
-          attr_accessor :version
-
-          def initialize(chart:, version:, repository: nil, **args)
-            super(**args)
-
-            # version is mandatory to prevent chart mismatches
-            # we do not want our values interpreted in the context of the wrong version
-            raise ArgumentError, 'version is required' if version.blank?
-
-            @chart = chart
-            @version = version
-            @repository = repository
-          end
-
-          def generate_script
-            super + [
-              repository_command,
-              repository_update_command,
-              upgrade_command
-            ].compact.join("\n")
-          end
-
-          private
-
-          def upgrade_command
-            command = ['helm', 'upgrade', name, chart] +
-              reuse_values_flag +
-              version_flag +
-              namespace_flag +
-              value_flag
-
-            command.shelljoin
-          end
-
-          def reuse_values_flag
-            ['--reuse-values']
-          end
-
-          def value_flag
-            ['-f', "/data/helm/#{name}/config/values.yaml"]
-          end
-
-          def version_flag
-            ['--version', version]
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/gitlab/regex.rb b/lib/gitlab/regex.rb
index db593234f8e..3640edbaa26 100644
--- a/lib/gitlab/regex.rb
+++ b/lib/gitlab/regex.rb
@@ -466,7 +466,7 @@ module Gitlab
     # ```
     MARKDOWN_CODE_BLOCK_REGEX_UNTRUSTED =
       '(?P<code>' \
-        '^```\n' \
+        '^```.*?\n' \
         '(?:\n|.)*?' \
         '\n```\ *$' \
       ')'.freeze
@@ -484,6 +484,17 @@ module Gitlab
       )
     }mx.freeze
 
+    # HTML block:
+    # <tag>
+    # Anything, including `>>>` blocks which are ignored by this filter
+    # </tag>
+    MARKDOWN_HTML_BLOCK_REGEX_UNTRUSTED =
+      '(?P<html>' \
+        '^<[^>]+?>\ *\n' \
+        '(?:\n|.)*?' \
+        '\n<\/[^>]+?>\ *$' \
+      ')'.freeze
+
     # HTML comment line:
     # <!-- some commented text -->
     MARKDOWN_HTML_COMMENT_LINE_REGEX_UNTRUSTED =
@@ -506,6 +517,13 @@ module Gitlab
       }mx.freeze
     end
 
+    def markdown_code_or_html_blocks_untrusted
+      @markdown_code_or_html_blocks_untrusted ||=
+        "#{MARKDOWN_CODE_BLOCK_REGEX_UNTRUSTED}" \
+        "|" \
+        "#{MARKDOWN_HTML_BLOCK_REGEX_UNTRUSTED}"
+    end
+
     def markdown_code_or_html_comments_untrusted
       @markdown_code_or_html_comments_untrusted ||=
         "#{MARKDOWN_CODE_BLOCK_REGEX_UNTRUSTED}" \
@@ -515,6 +533,17 @@ module Gitlab
         "#{MARKDOWN_HTML_COMMENT_BLOCK_REGEX_UNTRUSTED}"
     end
 
+    def markdown_code_or_html_blocks_or_html_comments_untrusted
+      @markdown_code_or_html_comments_untrusted ||=
+        "#{MARKDOWN_CODE_BLOCK_REGEX_UNTRUSTED}" \
+        "|" \
+        "#{MARKDOWN_HTML_BLOCK_REGEX_UNTRUSTED}" \
+        "|" \
+        "#{MARKDOWN_HTML_COMMENT_LINE_REGEX_UNTRUSTED}" \
+        "|" \
+        "#{MARKDOWN_HTML_COMMENT_BLOCK_REGEX_UNTRUSTED}"
+    end
+
     # Based on Jira's project key format
     # https://confluence.atlassian.com/adminjiraserver073/changing-the-project-key-format-861253229.html
     # Avoids linking CVE IDs (https://cve.mitre.org/cve/identifiers/syntaxchange.html#new) as Jira issues.
diff --git a/lib/gitlab/untrusted_regexp.rb b/lib/gitlab/untrusted_regexp.rb
index 7c7bda3a8f9..b7817a0c141 100644
--- a/lib/gitlab/untrusted_regexp.rb
+++ b/lib/gitlab/untrusted_regexp.rb
@@ -29,6 +29,27 @@ module Gitlab
       RE2.GlobalReplace(text, regexp, rewrite)
     end
 
+    # There is no built-in replace with block support (like `gsub`).  We can accomplish
+    # the same thing by parsing and rebuilding the string with the substitutions.
+    def replace_gsub(text)
+      new_text = +''
+      remainder = text
+
+      matched = match(remainder)
+
+      until matched.nil? || matched.to_a.compact.empty?
+        partitioned = remainder.partition(matched.to_s)
+        new_text << partitioned.first
+        remainder = partitioned.last
+
+        new_text << yield(matched)
+
+        matched = match(remainder)
+      end
+
+      new_text << remainder
+    end
+
     def scan(text)
       matches = scan_regexp.scan(text).to_a
       matches.map!(&:first) if regexp.number_of_capturing_groups == 0
diff --git a/lib/sidebars/projects/menus/issues_menu.rb b/lib/sidebars/projects/menus/issues_menu.rb
index a7f9ddde247..38eab0e3b68 100644
--- a/lib/sidebars/projects/menus/issues_menu.rb
+++ b/lib/sidebars/projects/menus/issues_menu.rb
@@ -57,7 +57,8 @@ module Sidebars
         override :pill_count
         def pill_count
           strong_memoize(:pill_count) do
-            context.project.open_issues_count(context.current_user)
+            count = context.project.open_issues_count(context.current_user)
+            format_cached_count(1000, count)
           end
         end
 
diff --git a/lib/sidebars/projects/menus/merge_requests_menu.rb b/lib/sidebars/projects/menus/merge_requests_menu.rb
index cc7fda0c920..be80a58d5f1 100644
--- a/lib/sidebars/projects/menus/merge_requests_menu.rb
+++ b/lib/sidebars/projects/menus/merge_requests_menu.rb
@@ -46,7 +46,8 @@ module Sidebars
 
         override :pill_count
         def pill_count
-          @pill_count ||= context.project.open_merge_requests_count
+          count = @pill_count ||= context.project.open_merge_requests_count
+          format_cached_count(1000, count)
         end
 
         override :pill_html_options
diff --git a/lib/sidebars/projects/menus/packages_registries_menu.rb b/lib/sidebars/projects/menus/packages_registries_menu.rb
index d5b590a03aa..b75445cdc5c 100644
--- a/lib/sidebars/projects/menus/packages_registries_menu.rb
+++ b/lib/sidebars/projects/menus/packages_registries_menu.rb
@@ -65,7 +65,7 @@ module Sidebars
           end
 
           ::Sidebars::MenuItem.new(
-            title: _('Infrastructure Registry'),
+            title: _('Terraform modules'),
             link: project_infrastructure_registry_index_path(context.project),
             super_sidebar_parent: Sidebars::Projects::SuperSidebarMenus::OperationsMenu,
             active_routes: { controller: :infrastructure_registry },
diff --git a/lib/sidebars/search/panel.rb b/lib/sidebars/search/panel.rb
new file mode 100644
index 00000000000..d606dc388b5
--- /dev/null
+++ b/lib/sidebars/search/panel.rb
@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Sidebars
+  module Search
+    class Panel < ::Sidebars::Panel
+      override :aria_label
+      def aria_label
+        _('Search')
+      end
+
+      override :super_sidebar_context_header
+      def super_sidebar_context_header
+        @super_sidebar_context_header ||= {
+          title: aria_label,
+          icon: 'search'
+        }
+      end
+    end
+  end
+end