summaryrefslogtreecommitdiff
path: root/spec/requests
diff options
context:
space:
mode:
authorMarin Jankovski <marin@gitlab.com>2019-07-02 06:23:28 +0000
committerMarin Jankovski <marin@gitlab.com>2019-07-02 06:23:28 +0000
commitfa77293bdca13d056dc7214583c3a0b370d18531 (patch)
tree85b973f49e50dbbf241dc7e954c46c5b6ec9ba86 /spec/requests
parent108a6e4f3abb17b58903979ad1c2fc95d8715b85 (diff)
parent4b8097c79ef5a891f5daac6f53af41b41209720e (diff)
downloadgitlab-ce-fa77293bdca13d056dc7214583c3a0b370d18531.tar.gz
Merge branch 'security-mr-head-pipeline-leak' into 'master'
[master] Fix MR head pipeline leak See merge request gitlab/gitlabhq!3148
Diffstat (limited to 'spec/requests')
-rw-r--r--spec/requests/api/merge_requests_spec.rb25
1 files changed, 25 insertions, 0 deletions
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 76d093e0774..a82ecb4fd63 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -834,6 +834,31 @@ describe API::MergeRequests do
end
end
+ context 'head_pipeline' do
+ before do
+ merge_request.update(head_pipeline: create(:ci_pipeline))
+ merge_request.project.project_feature.update(builds_access_level: 10)
+ end
+
+ context 'when user can read the pipeline' do
+ it 'exposes pipeline information' do
+ get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user)
+
+ expect(json_response).to include('head_pipeline')
+ end
+ end
+
+ context 'when user can not read the pipeline' do
+ let(:guest) { create(:user) }
+
+ it 'does not expose pipeline information' do
+ get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", guest)
+
+ expect(json_response).not_to include('head_pipeline')
+ end
+ end
+ end
+
it 'returns the commits behind the target branch when include_diverged_commits_count is present' do
allow_any_instance_of(merge_request.class).to receive(:diverged_commits_count).and_return(1)