Wrap all UntrustedRegexp patterns in () for RE2untrusted-regexp-match-groups-bugfix

- Add () wrapping to all patterns in UntrustedRegexp#scan_regex
- Opt in to match-data formatting for patterns with match groups, since
  they all do now
- Add Matches operator and statement specs reproducing the reported
  error, with correct result values

2 files changed, 31 insertions, 1 deletions

diff --git a/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb b/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
index 97da66d2bcc..fb630ea1d09 100644
--- a/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/expression/lexeme/matches_spec.rb
@@ -1,4 +1,4 @@
-require 'fast_spec_helper'
+require 'spec_helper'
 require_dependency 're2'
 
 describe Gitlab::Ci::Pipeline::Expression::Lexeme::Matches do
@@ -67,6 +67,27 @@ describe Gitlab::Ci::Pipeline::Expression::Lexeme::Matches do
       it { is_expected.to eq(nil) }
     end
 
+    context 'with an internal match group' do
+      let(:left_value)  { 'v11.11.3-rc1' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('^v\d+\.\d+\.\d+(-rc\d+)?$') }
+
+      it { is_expected.to eq(0) }
+    end
+
+    context 'with an all-compassing match group' do
+      let(:left_value)  { 'v11.11.3-rc1' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('(^v\d+\.\d+\.\d+-rc\d+?$)') }
+
+      it { is_expected.to eq(0) }
+    end
+
+    context 'with a nested match group' do
+      let(:left_value)  { 'v11.11.3-rc1' }
+      let(:right_value) { Gitlab::UntrustedRegexp.new('(^v\d+\.\d+\.\d+(-rc\d+)?$)') }
+
+      it { is_expected.to eq(0) }
+    end
+
     context 'when left is a multiline string and matches right' do
       let(:left_value) do
         <<~TEXT
diff --git a/spec/lib/gitlab/ci/pipeline/expression/statement_spec.rb b/spec/lib/gitlab/ci/pipeline/expression/statement_spec.rb
index 057e2f3fbe8..9aab9ce5a78 100644
--- a/spec/lib/gitlab/ci/pipeline/expression/statement_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/expression/statement_spec.rb
@@ -10,6 +10,9 @@ describe Gitlab::Ci::Pipeline::Expression::Statement do
 
   let(:variables) do
     {
+      'CI_COMMIT_TAG'      => 'v11.11.3',
+      'CI_COMMIT_REF_NAME' => '11-11-stable',
+      'GITLAB_VERSION'     => 'v11.11.3-ee',
       'PRESENT_VARIABLE'   => 'my variable',
       'PATH_VARIABLE'      => 'a/path/variable/value',
       'FULL_PATH_VARIABLE' => '/a/full/path/variable/value',
@@ -67,6 +70,12 @@ describe Gitlab::Ci::Pipeline::Expression::Statement do
       "$UNDEFINED_VARIABLE !~ /var.*/"                              | true
       "$PRESENT_VARIABLE !~ /VAR.*/i"                               | false
 
+      '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+(-rc\d+)?$/'       | 0
+      '$CI_COMMIT_REF_NAME =~ /^\d+-\d+-stable$/'           | 0
+      '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+(-rc\d+)?-ee$/'    | nil
+      '$CI_COMMIT_REF_NAME =~ /^\d+-\d+-stable-ee$/'        | nil
+      '$GITLAB_VERSION =~ /^v\d+\.\d+\.\d+(-rc\d+)?-ee$/'   | 0
+
       '$PRESENT_VARIABLE && "string"'          | 'string'
       '$PRESENT_VARIABLE && $PRESENT_VARIABLE' | 'my variable'
       '$PRESENT_VARIABLE && $EMPTY_VARIABLE'   | ''