summaryrefslogtreecommitdiff
path: root/spec/config
diff options
context:
space:
mode:
authorAndrew Newdigate <andrew@gitlab.com>2019-02-14 09:25:25 +0200
committerAndrew Newdigate <andrew@gitlab.com>2019-02-14 10:46:27 +0200
commite2cc500e4e6b27bd158a84cf7d38768fd28fa642 (patch)
treecc153cd1a83d6d4148c9c411d7583a045cef9782 /spec/config
parente927833b941122f25252712bc68b37041b38ba2c (diff)
downloadgitlab-ce-e2cc500e4e6b27bd158a84cf7d38768fd28fa642.tar.gz
Filter note parameters
This change adds `note` to the Rails `filter_parameters` configuration.
Diffstat (limited to 'spec/config')
-rw-r--r--spec/config/application_spec.rb34
1 files changed, 34 insertions, 0 deletions
diff --git a/spec/config/application_spec.rb b/spec/config/application_spec.rb
new file mode 100644
index 00000000000..01ed81964c3
--- /dev/null
+++ b/spec/config/application_spec.rb
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::Application do # rubocop:disable RSpec/FilePath
+ using RSpec::Parameterized::TableSyntax
+
+ FILTERED_PARAM = ActionDispatch::Http::ParameterFilter::FILTERED
+
+ context 'when parameters are logged' do
+ describe 'rails does not leak confidential parameters' do
+ def request_for_url(input_url)
+ env = Rack::MockRequest.env_for(input_url)
+ env['action_dispatch.parameter_filter'] = described_class.config.filter_parameters
+
+ ActionDispatch::Request.new(env)
+ end
+
+ where(:input_url, :output_query) do
+ '/' | {}
+ '/?safe=1' | { 'safe' => '1' }
+ '/?private_token=secret' | { 'private_token' => FILTERED_PARAM }
+ '/?mixed=1&private_token=secret' | { 'mixed' => '1', 'private_token' => FILTERED_PARAM }
+ '/?note=secret&noteable=1&prefix_note=2' | { 'note' => FILTERED_PARAM, 'noteable' => '1', 'prefix_note' => '2' }
+ '/?note[note]=secret&target_type=1' | { 'note' => FILTERED_PARAM, 'target_type' => '1' }
+ '/?safe[note]=secret&target_type=1' | { 'safe' => { 'note' => FILTERED_PARAM }, 'target_type' => '1' }
+ end
+
+ with_them do
+ it { expect(request_for_url(input_url).filtered_parameters).to eq(output_query) }
+ end
+ end
+ end
+end