Add latest changes from gitlab-org/gitlab@master

11 files changed, 151 insertions, 51 deletions

diff --git a/spec/support/helpers/prometheus_helpers.rb b/spec/support/helpers/prometheus_helpers.rb
index 0fdc4de1b36..fdce00e7dec 100644
--- a/spec/support/helpers/prometheus_helpers.rb
+++ b/spec/support/helpers/prometheus_helpers.rb
@@ -68,6 +68,21 @@ module PrometheusHelpers
       })
   end
 
+  def stub_prometheus_query_error(url, error_message = 'error', body: {}, headers: {})
+    response = {
+      status: 'error',
+      errorType: 'bad_data',
+      error: error_message
+    }.merge(body)
+
+    WebMock.stub_request(:get, url)
+      .to_return({
+        status: 400,
+        headers: { 'Content-Type' => 'application/json' }.merge(headers),
+        body: response.to_json
+      })
+  end
+
   def stub_prometheus_request_with_exception(url, exception_type)
     WebMock.stub_request(:get, url).to_raise(exception_type)
   end
diff --git a/spec/support/helpers/workhorse_helpers.rb b/spec/support/helpers/workhorse_helpers.rb
index 27d5083728d..de232da3c8c 100644
--- a/spec/support/helpers/workhorse_helpers.rb
+++ b/spec/support/helpers/workhorse_helpers.rb
@@ -76,7 +76,7 @@ module WorkhorseHelpers
       "#{key}.size" => file.size
     }.tap do |params|
       params["#{key}.path"] = file.path if file.path
-      params["#{key}.remote_id"] = file.remote_id if file.respond_to?(:remote_id) && file.remote_id
+      params["#{key}.remote_id"] = file.remote_id if file.respond_to?(:remote_id) && file.remote_id.present?
     end
   end
 
diff --git a/spec/support/shared_contexts/finders/issues_finder_shared_contexts.rb b/spec/support/shared_contexts/finders/issues_finder_shared_contexts.rb
index 6b950a354cf..fc62ae5a13f 100644
--- a/spec/support/shared_contexts/finders/issues_finder_shared_contexts.rb
+++ b/spec/support/shared_contexts/finders/issues_finder_shared_contexts.rb
@@ -1,23 +1,23 @@
 # frozen_string_literal: true
 
 RSpec.shared_context 'IssuesFinder context' do
-  set(:user) { create(:user) }
-  set(:user2) { create(:user) }
-  set(:group) { create(:group) }
-  set(:subgroup) { create(:group, parent: group) }
-  set(:project1) { create(:project, group: group) }
-  set(:project2) { create(:project) }
-  set(:project3) { create(:project, group: subgroup) }
-  set(:milestone) { create(:milestone, project: project1) }
-  set(:label) { create(:label, project: project2) }
-  set(:label2) { create(:label, project: project2) }
-  set(:issue1) { create(:issue, author: user, assignees: [user], project: project1, milestone: milestone, title: 'gitlab', created_at: 1.week.ago, updated_at: 1.week.ago) }
-  set(:issue2) { create(:issue, author: user, assignees: [user], project: project2, description: 'gitlab', created_at: 1.week.from_now, updated_at: 1.week.from_now) }
-  set(:issue3) { create(:issue, author: user2, assignees: [user2], project: project2, title: 'tanuki', description: 'tanuki', created_at: 2.weeks.from_now, updated_at: 2.weeks.from_now) }
-  set(:issue4) { create(:issue, project: project3) }
-  set(:award_emoji1) { create(:award_emoji, name: 'thumbsup', user: user, awardable: issue1) }
-  set(:award_emoji2) { create(:award_emoji, name: 'thumbsup', user: user2, awardable: issue2) }
-  set(:award_emoji3) { create(:award_emoji, name: 'thumbsdown', user: user, awardable: issue3) }
+  let_it_be(:user) { create(:user) }
+  let_it_be(:user2) { create(:user) }
+  let_it_be(:group) { create(:group) }
+  let_it_be(:subgroup) { create(:group, parent: group) }
+  let_it_be(:project1, reload: true) { create(:project, group: group) }
+  let_it_be(:project2, reload: true) { create(:project) }
+  let_it_be(:project3, reload: true) { create(:project, group: subgroup) }
+  let_it_be(:milestone) { create(:milestone, project: project1) }
+  let_it_be(:label) { create(:label, project: project2) }
+  let_it_be(:label2) { create(:label, project: project2) }
+  let_it_be(:issue1, reload: true) { create(:issue, author: user, assignees: [user], project: project1, milestone: milestone, title: 'gitlab', created_at: 1.week.ago, updated_at: 1.week.ago) }
+  let_it_be(:issue2, reload: true) { create(:issue, author: user, assignees: [user], project: project2, description: 'gitlab', created_at: 1.week.from_now, updated_at: 1.week.from_now) }
+  let_it_be(:issue3, reload: true) { create(:issue, author: user2, assignees: [user2], project: project2, title: 'tanuki', description: 'tanuki', created_at: 2.weeks.from_now, updated_at: 2.weeks.from_now) }
+  let_it_be(:issue4, reload: true) { create(:issue, project: project3) }
+  let_it_be(:award_emoji1) { create(:award_emoji, name: 'thumbsup', user: user, awardable: issue1) }
+  let_it_be(:award_emoji2) { create(:award_emoji, name: 'thumbsup', user: user2, awardable: issue2) }
+  let_it_be(:award_emoji3) { create(:award_emoji, name: 'thumbsdown', user: user, awardable: issue3) }
 end
 
 RSpec.shared_context 'IssuesFinder#execute context' do
diff --git a/spec/support/shared_contexts/finders/merge_requests_finder_shared_contexts.rb b/spec/support/shared_contexts/finders/merge_requests_finder_shared_contexts.rb
index 82190fb7793..617701abf27 100644
--- a/spec/support/shared_contexts/finders/merge_requests_finder_shared_contexts.rb
+++ b/spec/support/shared_contexts/finders/merge_requests_finder_shared_contexts.rb
@@ -13,15 +13,14 @@ RSpec.shared_context 'MergeRequestsFinder multiple projects with merge requests
     end
   end
 
-  set(:user)  { create(:user) }
-  set(:user2) { create(:user) }
-
-  set(:group) { create(:group) }
-  set(:subgroup) { create(:group, parent: group) }
-  set(:project1) do
+  let_it_be(:user)  { create(:user) }
+  let_it_be(:user2) { create(:user) }
+  let_it_be(:group) { create(:group) }
+  let_it_be(:subgroup) { create(:group, parent: group) }
+  let_it_be(:project1, reload: true) do
     allow_gitaly_n_plus_1 { create(:project, :public, group: group) }
   end
-  # We cannot use `set` here otherwise we get:
+  # We cannot use `let_it_be` here otherwise we get:
   #   Failure/Error: allow(RepositoryForkWorker).to receive(:perform_async).and_return(true)
   #   The use of doubles or partial doubles from rspec-mocks outside of the per-test lifecycle is not supported.
   let(:project2) do
@@ -36,13 +35,13 @@ RSpec.shared_context 'MergeRequestsFinder multiple projects with merge requests
       end
     end
   end
-  set(:project4) do
+  let_it_be(:project4, reload: true) do
     allow_gitaly_n_plus_1 { create(:project, :repository, group: subgroup) }
   end
-  set(:project5) do
+  let_it_be(:project5, reload: true) do
     allow_gitaly_n_plus_1 { create(:project, group: subgroup) }
   end
-  set(:project6) do
+  let_it_be(:project6, reload: true) do
     allow_gitaly_n_plus_1 { create(:project, group: subgroup) }
   end
 
diff --git a/spec/support/shared_contexts/finders/users_finder_shared_contexts.rb b/spec/support/shared_contexts/finders/users_finder_shared_contexts.rb
index a2fa3d7beac..fc8f9d2f407 100644
--- a/spec/support/shared_contexts/finders/users_finder_shared_contexts.rb
+++ b/spec/support/shared_contexts/finders/users_finder_shared_contexts.rb
@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 RSpec.shared_context 'UsersFinder#execute filter by project context' do
-  set(:normal_user) { create(:user, username: 'johndoe') }
-  set(:blocked_user) { create(:user, :blocked, username: 'notsorandom') }
-  set(:external_user) { create(:user, :external) }
-  set(:omniauth_user) { create(:omniauth_user, provider: 'twitter', extern_uid: '123456') }
+  let_it_be(:normal_user) { create(:user, username: 'johndoe') }
+  let_it_be(:blocked_user) { create(:user, :blocked, username: 'notsorandom') }
+  let_it_be(:external_user) { create(:user, :external) }
+  let_it_be(:omniauth_user) { create(:omniauth_user, provider: 'twitter', extern_uid: '123456') }
 end
diff --git a/spec/support/shared_contexts/mailers/notify_shared_context.rb b/spec/support/shared_contexts/mailers/notify_shared_context.rb
index d5b44f8df2c..de8c0d5d2b4 100644
--- a/spec/support/shared_contexts/mailers/notify_shared_context.rb
+++ b/spec/support/shared_contexts/mailers/notify_shared_context.rb
@@ -1,11 +1,10 @@
 # frozen_string_literal: true
 
 RSpec.shared_context 'gitlab email notification' do
-  set(:group) { create(:group) }
-  set(:subgroup) { create(:group, parent: group) }
-  set(:project) { create(:project, :repository, name: 'a-known-name', group: group) }
-  set(:recipient) { create(:user, email: 'recipient@example.com') }
-
+  let_it_be(:group, reload: true) { create(:group) }
+  let_it_be(:subgroup) { create(:group, parent: group) }
+  let_it_be(:project, reload: true) { create(:project, :repository, name: 'a-known-name', group: group) }
+  let_it_be(:recipient, reload: true) { create(:user, email: 'recipient@example.com') }
   let(:gitlab_sender_display_name) { Gitlab.config.gitlab.email_display_name }
   let(:gitlab_sender) { Gitlab.config.gitlab.email_from }
   let(:gitlab_sender_reply_to) { Gitlab.config.gitlab.email_reply_to }
diff --git a/spec/support/shared_contexts/policies/project_policy_shared_context.rb b/spec/support/shared_contexts/policies/project_policy_shared_context.rb
index 29a64e9b559..055164ec38e 100644
--- a/spec/support/shared_contexts/policies/project_policy_shared_context.rb
+++ b/spec/support/shared_contexts/policies/project_policy_shared_context.rb
@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
 RSpec.shared_context 'ProjectPolicy context' do
-  set(:guest) { create(:user) }
-  set(:reporter) { create(:user) }
-  set(:developer) { create(:user) }
-  set(:maintainer) { create(:user) }
-  set(:owner) { create(:user) }
-  set(:admin) { create(:admin) }
+  let_it_be(:guest) { create(:user) }
+  let_it_be(:reporter) { create(:user) }
+  let_it_be(:developer) { create(:user) }
+  let_it_be(:maintainer) { create(:user) }
+  let_it_be(:owner) { create(:user) }
+  let_it_be(:admin) { create(:admin) }
   let(:project) { create(:project, :public, namespace: owner.namespace) }
 
   let(:base_guest_permissions) do
diff --git a/spec/support/shared_examples/controllers/hotlink_interceptor_shared_examples.rb b/spec/support/shared_examples/controllers/hotlink_interceptor_shared_examples.rb
new file mode 100644
index 00000000000..93a394387a3
--- /dev/null
+++ b/spec/support/shared_examples/controllers/hotlink_interceptor_shared_examples.rb
@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples "hotlink interceptor" do
+  let(:http_request) { nil }
+  let(:headers) { nil }
+
+  describe "DDOS prevention" do
+    using RSpec::Parameterized::TableSyntax
+
+    context "hotlinked as media" do
+      where(:response_status, :accept_header) do
+        # These are default formats in modern browsers, and IE
+        :ok | "*/*"
+        :ok | "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
+        :ok | "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
+        :ok | "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
+        :ok | "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8"
+        :ok | "image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/msword, */*"
+        :ok | "text/html, application/xhtml+xml, image/jxr, */*"
+        :ok | "text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1"
+
+        # These are image request formats
+        :not_acceptable | "image/webp,*/*"
+        :not_acceptable | "image/png,image/*;q=0.8,*/*;q=0.5"
+        :not_acceptable | "image/webp,image/apng,image/*,*/*;q=0.8"
+        :not_acceptable | "image/png,image/svg+xml,image/*;q=0.8, */*;q=0.5"
+
+        # Video request formats
+        :not_acceptable | "video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5"
+
+        # Audio request formats
+        :not_acceptable | "audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5"
+
+        # CSS request formats
+        :not_acceptable | "text/css,*/*;q=0.1"
+        :not_acceptable | "text/css"
+        :not_acceptable | "text/css,*/*;q=0.1"
+      end
+
+      with_them do
+        let(:headers) do
+          { "Accept" => accept_header }
+        end
+
+        before do
+          request.headers.merge!(headers) if request.present?
+        end
+
+        it "renders the response" do
+          http_request
+
+          expect(response).to have_gitlab_http_status(response_status)
+        end
+      end
+    end
+
+    context "hotlinked as a script" do
+      where(:response_status, :fetch_mode) do
+        # Standard navigation fetch modes
+        :ok | "navigate"
+        :ok | "nested-navigate"
+        :ok | "same-origin"
+
+        # Fetch modes when linking as JS
+        :not_acceptable | "cors"
+        :not_acceptable | "no-cors"
+        :not_acceptable | "websocket"
+      end
+
+      with_them do
+        let(:headers) do
+          { "Sec-Fetch-Mode" => fetch_mode }
+        end
+
+        before do
+          request.headers.merge!(headers) if request.present?
+        end
+
+        it "renders the response" do
+          http_request
+
+          expect(response).to have_gitlab_http_status(response_status)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/support/shared_examples/finders/snippet_visibility_shared_examples.rb b/spec/support/shared_examples/finders/snippet_visibility_shared_examples.rb
index 98ab141ab26..5bd2da03f3f 100644
--- a/spec/support/shared_examples/finders/snippet_visibility_shared_examples.rb
+++ b/spec/support/shared_examples/finders/snippet_visibility_shared_examples.rb
@@ -8,12 +8,12 @@ RSpec.shared_examples 'snippet visibility' do
     DatabaseCleaner.clean_with(:truncation)
   end
 
-  set(:author) { create(:user) }
-  set(:member) { create(:user) }
-  set(:external) { create(:user, :external) }
-  set(:non_member) { create(:user) }
+  let_it_be(:author) { create(:user) }
+  let_it_be(:member) { create(:user) }
+  let_it_be(:external) { create(:user, :external) }
+  let_it_be(:non_member) { create(:user) }
 
-  set(:project) do
+  let_it_be(:project, reload: true) do
     create(:project).tap do |project|
       project.add_developer(author)
       project.add_developer(member)
diff --git a/spec/support/shared_examples/quick_actions/issuable/issuable_quick_actions_shared_examples.rb b/spec/support/shared_examples/quick_actions/issuable/issuable_quick_actions_shared_examples.rb
index 4db52795cd4..b03da4471bc 100644
--- a/spec/support/shared_examples/quick_actions/issuable/issuable_quick_actions_shared_examples.rb
+++ b/spec/support/shared_examples/quick_actions/issuable/issuable_quick_actions_shared_examples.rb
@@ -224,7 +224,7 @@ RSpec.shared_examples 'issuable quick actions' do
   end
 
   context 'when user can update issuable' do
-    set(:developer) { create(:user) }
+    let_it_be(:developer) { create(:user) }
     let(:note_author) { developer }
 
     before do
@@ -251,7 +251,7 @@ RSpec.shared_examples 'issuable quick actions' do
   end
 
   context 'when user cannot update issuable' do
-    set(:non_member) { create(:user) }
+    let_it_be(:non_member) { create(:user) }
     let(:note_author) { non_member }
 
     it 'applies commands that user can execute' do
diff --git a/spec/support/shared_examples/requests/api/boards_shared_examples.rb b/spec/support/shared_examples/requests/api/boards_shared_examples.rb
index 2bc79a2ef4d..20b0f4f0dd2 100644
--- a/spec/support/shared_examples/requests/api/boards_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/boards_shared_examples.rb
@@ -165,7 +165,7 @@ RSpec.shared_examples 'group and project boards' do |route_definition, ee = fals
     end
 
     context "when the user is parent owner" do
-      set(:owner) { create(:user) }
+      let_it_be(:owner, reload: true) { create(:user) }
 
       before do
         if board_parent.try(:namespace)