Merge remote-tracking branch 'upstream/master' into 42572-release-controller

* upstream/master: (889 commits)
  SlackService - respect `notify_only_default_branch` for push events
  Clarify usage ping wording in admin area
  Update incoming emails documents
  Allow to include also descendant group labels
  Update docs on grouping CI jobs
  Support additional LabelsFinder parameters for group labels
  Extend Cluster Applications to install GitLab Runner to Kubernetes cluster
  Remove registry list webpack entry point
  Remove trailing newline that was causing an EE conflict
  Small fixes in Vuex docs
  Remove u2f webpack bundle
  Update documentation WRT to request parameters
  remove common_vue CommonsChunk config
  Fetch commit signatures from Gitaly in batches
  migrate stl_viewer to dynamic import
  migrate sketch_viewer to dynamic import
  migrate pdf_viewer to dynamic import
  migrate notebook_viewer to dynamic import
  migrate balsamiq_viewer to dynamic import
  Add some strings that were missing in gitlab.pot
  ...

1 files changed, 60 insertions, 1 deletions

diff --git a/spec/lib/banzai/redactor_spec.rb b/spec/lib/banzai/redactor_spec.rb
index 2424c3fdc66..441f3725985 100644
--- a/spec/lib/banzai/redactor_spec.rb
+++ b/spec/lib/banzai/redactor_spec.rb
@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe Banzai::Redactor do
-  let(:user) { build(:user) }
+  let(:user) { create(:user) }
   let(:project) { build(:project) }
   let(:redactor) { described_class.new(project, user) }
 
@@ -40,6 +40,16 @@ describe Banzai::Redactor do
           expect(doc.to_html).to eq(original_content)
         end
       end
+
+      it 'returns <a> tag with original href if it is originally a link reference' do
+        href = 'http://localhost:3000'
+        doc = Nokogiri::HTML
+          .fragment("<a class='gfm' data-reference-type='issue' data-original=#{href} data-link-reference='true'>#{href}</a>")
+
+        redactor.redact([doc])
+
+        expect(doc.to_html).to eq('<a href="http://localhost:3000">http://localhost:3000</a>')
+      end
     end
 
     context 'when project is in pending delete' do
@@ -88,6 +98,55 @@ describe Banzai::Redactor do
     end
   end
 
+  context 'when the user cannot read cross project' do
+    include ActionView::Helpers::UrlHelper
+    let(:project) { create(:project) }
+    let(:other_project) { create(:project, :public) }
+
+    def create_link(issuable)
+      type = issuable.class.name.underscore.downcase
+      link_to(issuable.to_reference, '',
+              class: 'gfm has-tooltip',
+              title: issuable.title,
+              data: {
+                reference_type: type,
+                "#{type}": issuable.id
+              })
+    end
+
+    before do
+      project.add_developer(user)
+
+      allow(Ability).to receive(:allowed?).and_call_original
+      allow(Ability).to receive(:allowed?).with(user, :read_cross_project, :global) { false }
+      allow(Ability).to receive(:allowed?).with(user, :read_cross_project) { false }
+    end
+
+    it 'skips links to issues within the same project' do
+      issue = create(:issue, project: project)
+      link = create_link(issue)
+      doc = Nokogiri::HTML.fragment(link)
+
+      redactor.redact([doc])
+      result = doc.css('a').last
+
+      expect(result['class']).to include('has-tooltip')
+      expect(result['title']).to eq(issue.title)
+    end
+
+    it 'removes info from a cross project reference' do
+      issue = create(:issue, project: other_project)
+      link = create_link(issue)
+      doc = Nokogiri::HTML.fragment(link)
+
+      redactor.redact([doc])
+      result = doc.css('a').last
+
+      expect(result['class']).not_to include('has-tooltip')
+      expect(result['title']).to be_empty
+    end
+  end
+
   describe '#redact_nodes' do
     it 'redacts an Array of nodes' do
       doc = Nokogiri::HTML.fragment('<a href="foo">foo</a>')