Add latest changes from gitlab-org/security/gitlab@14-10-stable-ee

3 files changed, 75 insertions, 0 deletions

diff --git a/spec/controllers/projects/artifacts_controller_spec.rb b/spec/controllers/projects/artifacts_controller_spec.rb
index d51880b282d..958fcd4360c 100644
--- a/spec/controllers/projects/artifacts_controller_spec.rb
+++ b/spec/controllers/projects/artifacts_controller_spec.rb
@@ -204,6 +204,44 @@ RSpec.describe Projects::ArtifactsController do
         end
       end
     end
+
+    context 'when downloading a debug trace' do
+      let(:file_type) { 'trace' }
+      let(:job) { create(:ci_build, :success, :trace_artifact, pipeline: pipeline) }
+
+      before do
+        create(:ci_job_variable, key: 'CI_DEBUG_TRACE', value: 'true', job: job)
+      end
+
+      context 'when the user does not have update_build permissions' do
+        let(:user) { create(:user) }
+
+        before do
+          project.add_guest(user)
+        end
+
+        render_views
+
+        it 'denies the user access' do
+          download_artifact(file_type: file_type)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+          expect(response.body).to include(
+            'You must have developer or higher permissions in the associated project to view job logs when debug trace is enabled. ' \
+            'To disable debug trace, set the 'CI_DEBUG_TRACE' variable to 'false' in your pipeline configuration or CI/CD settings. ' \
+            'If you need to view this job log, a project maintainer must add you to the project with developer permissions or higher.'
+          )
+        end
+      end
+
+      context 'when the user has update_build permissions' do
+        it 'sends the trace' do
+          download_artifact(file_type: file_type)
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+      end
+    end
   end
 
   describe 'GET browse' do
diff --git a/spec/models/commit_status_spec.rb b/spec/models/commit_status_spec.rb
index 155e0fbb0e9..d158a99ef9f 100644
--- a/spec/models/commit_status_spec.rb
+++ b/spec/models/commit_status_spec.rb
@@ -618,6 +618,7 @@ RSpec.describe CommitStatus do
       'rspec:windows 10000 20000'                           | 'rspec:windows'
       'rspec:windows 0 : / 1'                               | 'rspec:windows'
       'rspec:windows 0 : / 1 name'                          | 'rspec:windows 0 : / 1 name'
+      'rspec [inception: [something, other thing], value]'  | 'rspec'
       '0 1 name ruby'                                       | '0 1 name ruby'
       '0 :/ 1 name ruby'                                    | '0 :/ 1 name ruby'
       'rspec: [aws]'                                        | 'rspec'
diff --git a/spec/models/integrations/every_integration_spec.rb b/spec/models/integrations/every_integration_spec.rb
new file mode 100644
index 00000000000..33e89b3dabc
--- /dev/null
+++ b/spec/models/integrations/every_integration_spec.rb
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Every integration' do
+  all_integration_names = Integration.available_integration_names
+
+  all_integration_names.each do |integration_name|
+    describe integration_name do
+      let(:integration_class) { Integration.integration_name_to_model(integration_name) }
+      let(:integration) { integration_class.new }
+
+      context 'secret fields', :aggregate_failures do
+        it "uses type: 'password' for all secret fields" do
+          integration.fields.each do |field|
+            next unless Integrations::Field::SECRET_NAME.match?(field[:name])
+
+            expect(field[:type]).to eq('password'),
+              "Field '#{field[:name]}' should use type 'password'"
+          end
+        end
+
+        it 'defines non-empty titles and help texts for all secret fields' do
+          integration.fields.each do |field|
+            next unless field[:type] == 'password'
+
+            expect(field[:non_empty_password_title]).to be_present,
+              "Field '#{field[:name]}' should define :non_empty_password_title"
+            expect(field[:non_empty_password_help]).to be_present,
+              "Field '#{field[:name]}' should define :non_empty_password_help"
+          end
+        end
+      end
+    end
+  end
+end