1 files changed, 129 insertions, 0 deletions
diff --git a/config/initializers/rack_attack_new.rb b/config/initializers/rack_attack_new.rb
new file mode 100644
index 00000000000..b0f7febe427
--- /dev/null
+++ b/config/initializers/rack_attack_new.rb
@@ -0,0 +1,129 @@
+module Gitlab::Throttle
+  def self.settings
+    Gitlab::CurrentSettings.current_application_settings
+  end
+
+  def self.protected_paths_enabled?
+    !self.omnibus_protected_paths_present? &&
+      self.settings.throttle_protected_paths_enabled?
+  end
+
+  def self.omnibus_protected_paths_present?
+    Rack::Attack.throttles.key?('protected paths')
+  end
+
+  def self.unauthenticated_options
+    limit_proc = proc { |req| settings.throttle_unauthenticated_requests_per_period }
+    period_proc = proc { |req| settings.throttle_unauthenticated_period_in_seconds.seconds }
+    { limit: limit_proc, period: period_proc }
+  end
+
+  def self.authenticated_api_options
+    limit_proc = proc { |req| settings.throttle_authenticated_api_requests_per_period }
+    period_proc = proc { |req| settings.throttle_authenticated_api_period_in_seconds.seconds }
+    { limit: limit_proc, period: period_proc }
+  end
+
+  def self.authenticated_web_options
+    limit_proc = proc { |req| settings.throttle_authenticated_web_requests_per_period }
+    period_proc = proc { |req| settings.throttle_authenticated_web_period_in_seconds.seconds }
+    { limit: limit_proc, period: period_proc }
+  end
+
+  def self.protected_paths_options
+    limit_proc = proc { |req| settings.throttle_protected_paths_requests_per_period }
+    period_proc = proc { |req| settings.throttle_protected_paths_period_in_seconds.seconds }
+
+    { limit: limit_proc, period: period_proc }
+  end
+end
+
+class Rack::Attack
+  throttle('throttle_unauthenticated', Gitlab::Throttle.unauthenticated_options) do |req|
+    Gitlab::Throttle.settings.throttle_unauthenticated_enabled &&
+      req.unauthenticated? &&
+      !req.should_be_skipped? &&
+      req.ip
+  end
+
+  throttle('throttle_authenticated_api', Gitlab::Throttle.authenticated_api_options) do |req|
+    Gitlab::Throttle.settings.throttle_authenticated_api_enabled &&
+      req.api_request? &&
+      req.authenticated_user_id([:api])
+  end
+
+  throttle('throttle_authenticated_web', Gitlab::Throttle.authenticated_web_options) do |req|
+    Gitlab::Throttle.settings.throttle_authenticated_web_enabled &&
+      req.web_request? &&
+      req.authenticated_user_id([:api, :rss, :ics])
+  end
+
+  throttle('throttle_unauthenticated_protected_paths', Gitlab::Throttle.protected_paths_options) do |req|
+    Gitlab::Throttle.protected_paths_enabled? &&
+      req.unauthenticated? &&
+      !req.should_be_skipped? &&
+      req.protected_path? &&
+      req.ip
+  end
+
+  throttle('throttle_authenticated_protected_paths_api', Gitlab::Throttle.protected_paths_options) do |req|
+    Gitlab::Throttle.protected_paths_enabled? &&
+      req.api_request? &&
+      req.protected_path? &&
+      req.authenticated_user_id([:api])
+  end
+
+  throttle('throttle_authenticated_protected_paths_web', Gitlab::Throttle.protected_paths_options) do |req|
+    Gitlab::Throttle.protected_paths_enabled? &&
+      req.web_request? &&
+      req.protected_path? &&
+      req.authenticated_user_id([:api, :rss, :ics])
+  end
+
+  class Request
+    def unauthenticated?
+      !authenticated_user_id([:api, :rss, :ics])
+    end
+
+    def authenticated_user_id(request_formats)
+      Gitlab::Auth::RequestAuthenticator.new(self).user(request_formats)&.id
+    end
+
+    def api_request?
+      path.start_with?('/api')
+    end
+
+    def api_internal_request?
+      path =~ %r{^/api/v\d+/internal/}
+    end
+
+    def should_be_skipped?
+      api_internal_request?
+    end
+
+    def web_request?
+      !api_request?
+    end
+
+    def protected_path?
+      !protected_path_regex.nil?
+    end
+
+    def protected_path_regex
+      path =~ protected_paths_regex
+    end
+
+    private
+
+    def protected_paths
+      Gitlab::CurrentSettings.current_application_settings.protected_paths
+    end
+
+    def protected_paths_regex
+      Regexp.union(protected_paths.map { |path| /\A#{Regexp.escape(path)}/ })
+    end
+  end
+end
+
+::Rack::Attack.extend_if_ee('::EE::Gitlab::Rack::Attack') # rubocop: disable Cop/InjectEnterpriseEditionModule
+::Rack::Attack::Request.prepend_if_ee('::EE::Gitlab::Rack::Attack::Request')