diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-03-30 22:40:10 +0000 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-03-30 22:40:10 +0000 |
commit | b8cacd68a6297f2c6cdd454a3d82a487367f2e70 (patch) | |
tree | 093014d689cb2c662f8f3f112791d952263a3b1a /spec | |
parent | b2ce3643e27db4cc0ad30cc09d651c00ec799887 (diff) | |
download | gitlab-ce-b8cacd68a6297f2c6cdd454a3d82a487367f2e70.tar.gz |
Add latest changes from gitlab-org/security/gitlab@13-10-stable-ee
Diffstat (limited to 'spec')
-rw-r--r-- | spec/lib/gitlab/asciidoc_spec.rb | 43 | ||||
-rw-r--r-- | spec/lib/gitlab/user_access_spec.rb | 9 | ||||
-rw-r--r-- | spec/models/project_spec.rb | 58 |
3 files changed, 110 insertions, 0 deletions
diff --git a/spec/lib/gitlab/asciidoc_spec.rb b/spec/lib/gitlab/asciidoc_spec.rb index 08510d4652b..3eb015a5a22 100644 --- a/spec/lib/gitlab/asciidoc_spec.rb +++ b/spec/lib/gitlab/asciidoc_spec.rb @@ -92,6 +92,15 @@ module Gitlab expect(render(data[:input], context)).to include(data[:output]) end end + + it 'does not allow locked attributes to be overridden' do + input = <<~ADOC + {counter:max-include-depth:1234} + <|-- {max-include-depth} + ADOC + + expect(render(input, {})).not_to include('1234') + end end context "images" do @@ -543,6 +552,40 @@ module Gitlab expect(render(input, context)).to include(output.strip) end + + it 'does not allow kroki-plantuml-include to be overridden' do + input = <<~ADOC + [plantuml, test="{counter:kroki-plantuml-include:/etc/passwd}", format="png"] + .... + class BlockProcessor + + BlockProcessor <|-- {counter:kroki-plantuml-include} + .... + ADOC + + output = <<~HTML + <div> + <div> + <a class=\"no-attachment-icon\" href=\"https://kroki.io/plantuml/png/eNpLzkksLlZwyslPzg4oyk9OLS7OL-LiQuUr2NTo6ipUJ-eX5pWkFlllF-VnZ-oW5CTmlZTm5uhm5iXnlKak1gIABQEb8A==\" target=\"_blank\" rel=\"noopener noreferrer\"><img src=\"data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" alt=\"Diagram\" class=\"lazy\" data-src=\"https://kroki.io/plantuml/png/eNpLzkksLlZwyslPzg4oyk9OLS7OL-LiQuUr2NTo6ipUJ-eX5pWkFlllF-VnZ-oW5CTmlZTm5uhm5iXnlKak1gIABQEb8A==\"></a> + </div> + </div> + HTML + + expect(render(input, {})).to include(output.strip) + end + + it 'does not allow kroki-server-url to be overridden' do + input = <<~ADOC + [plantuml, test="{counter:kroki-server-url:evilsite}", format="png"] + .... + class BlockProcessor + + BlockProcessor + .... + ADOC + + expect(render(input, {})).not_to include('evilsite') + end end context 'with Kroki and BlockDiag (additional format) enabled' do diff --git a/spec/lib/gitlab/user_access_spec.rb b/spec/lib/gitlab/user_access_spec.rb index 97fff030906..01890305df4 100644 --- a/spec/lib/gitlab/user_access_spec.rb +++ b/spec/lib/gitlab/user_access_spec.rb @@ -216,6 +216,15 @@ RSpec.describe Gitlab::UserAccess do expect(access.can_merge_to_branch?(@branch.name)).to be_falsey end end + + context 'when skip_collaboration_check is true' do + let(:access) { described_class.new(user, container: project, skip_collaboration_check: true) } + + it 'does not call Project#branch_allows_collaboration?' do + expect(project).not_to receive(:branch_allows_collaboration?) + expect(access.can_push_to_branch?('master')).to be_falsey + end + end end describe '#can_create_tag?' do diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb index 1cee494989d..49d9fd56d70 100644 --- a/spec/models/project_spec.rb +++ b/spec/models/project_spec.rb @@ -5291,6 +5291,64 @@ RSpec.describe Project, factory_default: :keep do end end + describe '#branch_allows_collaboration?' do + context 'when there are open merge requests that have their source/target branches point to each other' do + let_it_be(:project) { create(:project, :repository) } + let_it_be(:developer) { create(:user) } + let_it_be(:reporter) { create(:user) } + let_it_be(:guest) { create(:user) } + + before_all do + create( + :merge_request, + target_project: project, + target_branch: 'master', + source_project: project, + source_branch: 'merge-test', + allow_collaboration: true + ) + + create( + :merge_request, + target_project: project, + target_branch: 'merge-test', + source_project: project, + source_branch: 'master', + allow_collaboration: true + ) + + project.add_developer(developer) + project.add_reporter(reporter) + project.add_guest(guest) + end + + shared_examples_for 'successful check' do + it 'does not go into an infinite loop' do + expect { project.branch_allows_collaboration?(user, 'master') } + .not_to raise_error + end + end + + context 'when user is a developer' do + let(:user) { developer } + + it_behaves_like 'successful check' + end + + context 'when user is a reporter' do + let(:user) { reporter } + + it_behaves_like 'successful check' + end + + context 'when user is a guest' do + let(:user) { guest } + + it_behaves_like 'successful check' + end + end + end + context 'with cross project merge requests' do let(:user) { create(:user) } let(:target_project) { create(:project, :repository) } |