Wrap all UntrustedRegexp patterns in () for RE2untrusted-regexp-match-groups-bugfix

- Add () wrapping to all patterns in UntrustedRegexp#scan_regex
- Opt in to match-data formatting for patterns with match groups, since
  they all do now
- Add Matches operator and statement specs reproducing the reported
  error, with correct result values

2 files changed, 3 insertions, 12 deletions

diff --git a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
index ecfab627226..61f2402fad4 100644
--- a/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
+++ b/lib/gitlab/ci/pipeline/expression/lexeme/matches.rb
@@ -12,8 +12,6 @@ module Gitlab
               text = @left.evaluate(variables)
               regexp = @right.evaluate(variables)
 
-              regexp.scan(text.to_s).any?
-
               if ci_variables_complex_expressions?
                 # return offset of first match, or nil if no matches
                 if match = regexp.scan(text.to_s).first
diff --git a/lib/gitlab/untrusted_regexp.rb b/lib/gitlab/untrusted_regexp.rb
index c237f4a7404..893ec7c7fea 100644
--- a/lib/gitlab/untrusted_regexp.rb
+++ b/lib/gitlab/untrusted_regexp.rb
@@ -30,9 +30,7 @@ module Gitlab
     end
 
     def scan(text)
-      matches = scan_regexp.scan(text).to_a
-      matches.map!(&:first) if regexp.number_of_capturing_groups.zero?
-      matches
+      scan_regexp.scan(text).to_a.map(&:first)
     end
 
     def match?(text)
@@ -65,14 +63,9 @@ module Gitlab
     attr_reader :regexp
 
     # RE2 scan operates differently to Ruby scan when there are no capture
-    # groups, so work around it
+    # groups, so always add one
     def scan_regexp
-      @scan_regexp ||=
-        if regexp.number_of_capturing_groups.zero?
-          RE2::Regexp.new('(' + regexp.source + ')')
-        else
-          regexp
-        end
+      @scan_regexp ||= RE2::Regexp.new('(' + regexp.source + ')')
     end
   end
 end