Merge branch '64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500' into 'master'

Fix 500 errors caused by pattern matching with variables in CI Lint

Closes #64383

See merge request gitlab-org/gitlab-ce!31719

5 files changed, 65 insertions, 2 deletions

diff --git a/changelogs/unreleased/64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500.yml b/changelogs/unreleased/64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500.yml
new file mode 100644
index 00000000000..ba4bd614170
--- /dev/null
+++ b/changelogs/unreleased/64383-pattern-matching-with-variables-causes-gitlabs-ci-lint-to-throw-500.yml
@@ -0,0 +1,5 @@
+---
+title: Fix 500 errors caused by pattern matching with variables in CI Lint
+merge_request: 31719
+author:
+type: fixed
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
index 942e4e55323..f7b0720d4a9 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
@@ -11,8 +11,9 @@ module Gitlab
             def evaluate(variables = {})
               text = @left.evaluate(variables)
               regexp = @right.evaluate(variables)
+              return false unless regexp
 
-              regexp.scan(text.to_s).any?
+              regexp.scan(text.to_s).present?
             end
 
             def self.build(_value, behind, ahead)
diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
index 831c27fa0ea..02479ed28a4 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/not_matches.rb
@@ -11,8 +11,9 @@ module Gitlab
             def evaluate(variables = {})
               text = @left.evaluate(variables)
               regexp = @right.evaluate(variables)
+              return true unless regexp
 
-              regexp.scan(text.to_s).none?
+              regexp.scan(text.to_s).empty?
             end
 
             def self.build(_value, behind, ahead)
diff --git a/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb b/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
index 4e4f1bf6ad3..a527783ffac 100644
--- a/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
@@ -69,6 +69,34 @@ describe Gitlab::Ci::Pipeline::Expression::Lexeme::Matches do
       it { is_expected.to eq(false) }
     end
 
+    context 'when right is nil' do
+      let(:left_value)  { 'my-awesome-string' }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'when left and right are nil' do
+      let(:left_value)  { nil }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'when left is an empty string' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('pattern') }
+
+      it { is_expected.to eq(false) }
+    end
+
+    context 'when left and right are empty strings' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('') }
+
+      it { is_expected.to eq(true) }
+    end
+
     context 'when left is a multiline string and matches right' do
       let(:left_value) do
         <<~TEXT
diff --git a/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb b/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb
index 6b81008ffb1..fb4238ecaf3 100644
--- a/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/expression/lexeme/not_matches_spec.rb
@@ -69,6 +69,34 @@ describe Gitlab::Ci::Pipeline::Expression::Lexeme::NotMatches do
       it { is_expected.to eq(true) }
     end
 
+    context 'when right is nil' do
+      let(:left_value)  { 'my-awesome-string' }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when left and right are nil' do
+      let(:left_value)  { nil }
+      let(:right_value) { nil }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when left is an empty string' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('pattern') }
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when left and right are empty strings' do
+      let(:left_value)  { '' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('') }
+
+      it { is_expected.to eq(false) }
+    end
+
     context 'when left is a multiline string and matches right' do
       let(:left_value) do
         <<~TEXT