From b6ca523cf7b8f7339d13d730c9fa24e7cac3263b Mon Sep 17 00:00:00 2001
From: Willian Balmant <willchb@gmail.com>
Date: Thu, 4 Apr 2019 23:03:51 +0000
Subject: No leading/trailing spaces when generating heading ids (Fixes #57528)

---
 lib/banzai/filter/table_of_contents_filter.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'lib')

diff --git a/lib/banzai/filter/table_of_contents_filter.rb b/lib/banzai/filter/table_of_contents_filter.rb
index f2ae17b44fa..d4cf08be0ae 100644
--- a/lib/banzai/filter/table_of_contents_filter.rb
+++ b/lib/banzai/filter/table_of_contents_filter.rb
@@ -18,6 +18,7 @@ module Banzai
     #          `li` child elements.
     class TableOfContentsFilter < HTML::Pipeline::Filter
       PUNCTUATION_REGEXP = /[^\p{Word}\- ]/u
+      LEADING_OR_TRAILING_SPACE_REGEXP = /^\p{Space}|\p{Space}$/
 
       def call
         return doc if context[:no_header_anchors]
@@ -31,6 +32,7 @@ module Banzai
           if header_content = node.children.first
             id = node
               .text
+              .gsub(LEADING_OR_TRAILING_SPACE_REGEXP, '') # remove leading and trailing spaces
               .downcase
               .gsub(PUNCTUATION_REGEXP, '') # remove punctuation
               .tr(' ', '-') # replace spaces with dash
-- 
cgit v1.2.1


From 2075ef7d071286ad156ca13640336572bb20bceb Mon Sep 17 00:00:00 2001
From: Willian Balmant <willchb@gmail.com>
Date: Wed, 10 Apr 2019 20:50:26 +0000
Subject: No leading/trailing spaces when generating heading ids (Fixes #57528)

Update based on comments in MR #27025
---
 lib/banzai/filter/table_of_contents_filter.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/banzai/filter/table_of_contents_filter.rb b/lib/banzai/filter/table_of_contents_filter.rb
index d4cf08be0ae..8d79f5bd58b 100644
--- a/lib/banzai/filter/table_of_contents_filter.rb
+++ b/lib/banzai/filter/table_of_contents_filter.rb
@@ -17,8 +17,8 @@ module Banzai
     #   :toc - String containing Table of Contents data as a `ul` element with
     #          `li` child elements.
     class TableOfContentsFilter < HTML::Pipeline::Filter
-      PUNCTUATION_REGEXP = /[^\p{Word}\- ]/u
-      LEADING_OR_TRAILING_SPACE_REGEXP = /^\p{Space}|\p{Space}$/
+      PUNCTUATION_REGEXP = /[^\p{Word}\- ]/u.freeze
+      LEADING_OR_TRAILING_SPACE_REGEXP = /^\p{Space}+|\p{Space}+$/.freeze
 
       def call
         return doc if context[:no_header_anchors]
-- 
cgit v1.2.1


From b27b8dc0c2e38689f519198ea127b60437e13983 Mon Sep 17 00:00:00 2001
From: Willian Balmant <willchb@gmail.com>
Date: Thu, 11 Apr 2019 16:09:03 +0000
Subject: Use strip to remove leading/trailing spaces

Change based on comments in MR #27025
---
 lib/banzai/filter/table_of_contents_filter.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/banzai/filter/table_of_contents_filter.rb b/lib/banzai/filter/table_of_contents_filter.rb
index 8d79f5bd58b..ade4d260be1 100644
--- a/lib/banzai/filter/table_of_contents_filter.rb
+++ b/lib/banzai/filter/table_of_contents_filter.rb
@@ -18,7 +18,6 @@ module Banzai
     #          `li` child elements.
     class TableOfContentsFilter < HTML::Pipeline::Filter
       PUNCTUATION_REGEXP = /[^\p{Word}\- ]/u.freeze
-      LEADING_OR_TRAILING_SPACE_REGEXP = /^\p{Space}+|\p{Space}+$/.freeze
 
       def call
         return doc if context[:no_header_anchors]
@@ -32,7 +31,7 @@ module Banzai
           if header_content = node.children.first
             id = node
               .text
-              .gsub(LEADING_OR_TRAILING_SPACE_REGEXP, '') # remove leading and trailing spaces
+              .strip
               .downcase
               .gsub(PUNCTUATION_REGEXP, '') # remove punctuation
               .tr(' ', '-') # replace spaces with dash
-- 
cgit v1.2.1


From 447c40d58d63b9d10162100973884cb97e79f85d Mon Sep 17 00:00:00 2001
From: Fabien Catteau <fcatteau@gitlab.com>
Date: Fri, 3 May 2019 09:03:44 +0000
Subject: Propagate excluded paths to SAST & DS jobs

Propagate DS_EXCLUDED_PATHS to dependency_scanning job,
and SAST_EXCLUDED_PATHS and SAST_BANDIT_EXCLUDED_PATHS to sast job.
This makes possible to excluded certains paths from SAST reports
and Dependency Scanning reports, respectively.
---
 lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml | 1 +
 lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml                | 2 ++
 2 files changed, 3 insertions(+)

(limited to 'lib')

diff --git a/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
index 263221329ab..8dd9775c583 100644
--- a/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
@@ -35,6 +35,7 @@ dependency_scanning:
           DS_ANALYZER_IMAGE_PREFIX \
           DS_ANALYZER_IMAGE_TAG \
           DS_DEFAULT_ANALYZERS \
+          DS_EXCLUDED_PATHS \
           DEP_SCAN_DISABLE_REMOTE_CHECKS \
           DS_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
           DS_PULL_ANALYZER_IMAGE_TIMEOUT \
diff --git a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
index f0152cd4537..706692e063b 100644
--- a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
@@ -35,6 +35,8 @@ sast:
           SAST_ANALYZER_IMAGE_PREFIX \
           SAST_ANALYZER_IMAGE_TAG \
           SAST_DEFAULT_ANALYZERS \
+          SAST_EXCLUDED_PATHS \
+          SAST_BANDIT_EXCLUDED_PATHS \
           SAST_BRAKEMAN_LEVEL \
           SAST_GOSEC_LEVEL \
           SAST_FLAWFINDER_LEVEL \
-- 
cgit v1.2.1


From 241ba4be7989547b3bc3f9a1a20b8dee7a4e9a0c Mon Sep 17 00:00:00 2001
From: Krasimir Angelov <kangelov@gitlab.com>
Date: Fri, 3 May 2019 13:29:20 +0000
Subject: Allow guests users to access project releases

This is step one of resolving
https://gitlab.com/gitlab-org/gitlab-ce/issues/56838.

Here is what changed:
- Revert the security fix from bdee9e8412d.
- Do not leak repository information (tag name, commit) to guests in API
responses.
- Do not include links to source code in API responses for users that do
not have download_code access.
- Show Releases in sidebar for guests.
- Do not display links to source code under Assets for users that do not
have download_code access.

GET ':id/releases/:tag_name' still do not allow guests to access
releases. This is to prevent guessing tag existence.
---
 lib/api/entities.rb | 19 +++++++++++++++----
 lib/api/releases.rb | 16 ++++++++++------
 2 files changed, 25 insertions(+), 10 deletions(-)

(limited to 'lib')

diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index ee8480122c4..a228614f684 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -1156,22 +1156,33 @@ module API
       end
     end
 
-    class Release < TagRelease
+    class Release < Grape::Entity
       expose :name
+      expose :tag, as: :tag_name, if: lambda { |_, _| can_download_code? }
+      expose :description
       expose :description_html do |entity|
         MarkupHelper.markdown_field(entity, :description)
       end
       expose :created_at
       expose :author, using: Entities::UserBasic, if: -> (release, _) { release.author.present? }
-      expose :commit, using: Entities::Commit
+      expose :commit, using: Entities::Commit, if: lambda { |_, _| can_download_code? }
 
       expose :assets do
-        expose :assets_count, as: :count
-        expose :sources, using: Entities::Releases::Source
+        expose :assets_count, as: :count do |release, _|
+          assets_to_exclude = can_download_code? ? [] : [:sources]
+          release.assets_count(except: assets_to_exclude)
+        end
+        expose :sources, using: Entities::Releases::Source, if: lambda { |_, _| can_download_code? }
         expose :links, using: Entities::Releases::Link do |release, options|
           release.links.sorted
         end
       end
+
+      private
+
+      def can_download_code?
+        Ability.allowed?(options[:current_user], :download_code, object.project)
+      end
     end
 
     class Tag < Grape::Entity
diff --git a/lib/api/releases.rb b/lib/api/releases.rb
index cb85028f22c..6b17f4317db 100644
--- a/lib/api/releases.rb
+++ b/lib/api/releases.rb
@@ -23,7 +23,7 @@ module API
       get ':id/releases' do
         releases = ::ReleasesFinder.new(user_project, current_user).execute
 
-        present paginate(releases), with: Entities::Release
+        present paginate(releases), with: Entities::Release, current_user: current_user
       end
 
       desc 'Get a single project release' do
@@ -34,9 +34,9 @@ module API
         requires :tag_name, type: String, desc: 'The name of the tag', as: :tag
       end
       get ':id/releases/:tag_name', requirements: RELEASE_ENDPOINT_REQUIREMETS do
-        authorize_read_release!
+        authorize_download_code!
 
-        present release, with: Entities::Release
+        present release, with: Entities::Release, current_user: current_user
       end
 
       desc 'Create a new release' do
@@ -63,7 +63,7 @@ module API
           .execute
 
         if result[:status] == :success
-          present result[:release], with: Entities::Release
+          present result[:release], with: Entities::Release, current_user: current_user
         else
           render_api_error!(result[:message], result[:http_status])
         end
@@ -86,7 +86,7 @@ module API
           .execute
 
         if result[:status] == :success
-          present result[:release], with: Entities::Release
+          present result[:release], with: Entities::Release, current_user: current_user
         else
           render_api_error!(result[:message], result[:http_status])
         end
@@ -107,7 +107,7 @@ module API
           .execute
 
         if result[:status] == :success
-          present result[:release], with: Entities::Release
+          present result[:release], with: Entities::Release, current_user: current_user
         else
           render_api_error!(result[:message], result[:http_status])
         end
@@ -135,6 +135,10 @@ module API
         authorize! :destroy_release, release
       end
 
+      def authorize_download_code!
+        authorize! :download_code, release
+      end
+
       def release
         @release ||= user_project.releases.find_by_tag(params[:tag])
       end
-- 
cgit v1.2.1


From fee5b0a4bcdd39762f8d5239dc37686714fb865c Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Fri, 3 May 2019 10:25:53 -0700
Subject: Add logging for time and lint start

---
 lib/tasks/lint.rake | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lib')

diff --git a/lib/tasks/lint.rake b/lib/tasks/lint.rake
index c5d0f2c292f..fa45b092833 100644
--- a/lib/tasks/lint.rake
+++ b/lib/tasks/lint.rake
@@ -36,6 +36,7 @@ unless Rails.env.production?
         gettext:updated_check
         lint:static_verification
       ].each do |task|
+        warn "#{Time.now} Running #{task}\n"
         pid = Process.fork do
           rd_out, wr_out = IO.pipe
           rd_err, wr_err = IO.pipe
-- 
cgit v1.2.1


From 09b44072e7749248a0224840e72de1b2a5cac671 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Fri, 3 May 2019 13:12:15 -0700
Subject: Remove stdout/stderr capture in static-analysis

---
 lib/tasks/lint.rake | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

(limited to 'lib')

diff --git a/lib/tasks/lint.rake b/lib/tasks/lint.rake
index fa45b092833..7aab53491e6 100644
--- a/lib/tasks/lint.rake
+++ b/lib/tasks/lint.rake
@@ -37,14 +37,8 @@ unless Rails.env.production?
         lint:static_verification
       ].each do |task|
         warn "#{Time.now} Running #{task}\n"
-        pid = Process.fork do
-          rd_out, wr_out = IO.pipe
-          rd_err, wr_err = IO.pipe
-          stdout = $stdout.dup
-          stderr = $stderr.dup
-          $stdout.reopen(wr_out)
-          $stderr.reopen(wr_err)
 
+        pid = Process.fork do
           begin
             Rake::Task[task].invoke
           rescue SystemExit => ex
@@ -54,15 +48,7 @@ unless Rails.env.production?
             msg = "*** Rake task #{task} raised #{ex.class}:"
             raise ex
           ensure
-            $stdout.reopen(stdout)
-            $stderr.reopen(stderr)
-            wr_out.close
-            wr_err.close
-
             warn "\n#{msg}\n\n" if msg
-
-            IO.copy_stream(rd_out, $stdout)
-            IO.copy_stream(rd_err, $stderr)
           end
         end
 
-- 
cgit v1.2.1


From a5620a0d2332b2313849f87af802bfb5c9f7ff3f Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sun, 5 May 2019 03:19:05 -0700
Subject: Revert changes in lib/tasks/lint.rake

---
 lib/tasks/lint.rake | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/tasks/lint.rake b/lib/tasks/lint.rake
index 7aab53491e6..c5d0f2c292f 100644
--- a/lib/tasks/lint.rake
+++ b/lib/tasks/lint.rake
@@ -36,9 +36,14 @@ unless Rails.env.production?
         gettext:updated_check
         lint:static_verification
       ].each do |task|
-        warn "#{Time.now} Running #{task}\n"
-
         pid = Process.fork do
+          rd_out, wr_out = IO.pipe
+          rd_err, wr_err = IO.pipe
+          stdout = $stdout.dup
+          stderr = $stderr.dup
+          $stdout.reopen(wr_out)
+          $stderr.reopen(wr_err)
+
           begin
             Rake::Task[task].invoke
           rescue SystemExit => ex
@@ -48,7 +53,15 @@ unless Rails.env.production?
             msg = "*** Rake task #{task} raised #{ex.class}:"
             raise ex
           ensure
+            $stdout.reopen(stdout)
+            $stderr.reopen(stderr)
+            wr_out.close
+            wr_err.close
+
             warn "\n#{msg}\n\n" if msg
+
+            IO.copy_stream(rd_out, $stdout)
+            IO.copy_stream(rd_err, $stderr)
           end
         end
 
-- 
cgit v1.2.1


From f93b2e02a56a3b1f3041119e8302d43aeafc8284 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sun, 5 May 2019 03:19:14 -0700
Subject: Run rubocop -a on CE files

---
 lib/api/api.rb                                       |  2 +-
 lib/banzai/color_parser.rb                           | 20 ++++++++++----------
 lib/banzai/filter/autolink_filter.rb                 |  2 +-
 lib/banzai/filter/front_matter_filter.rb             |  2 +-
 lib/banzai/filter/spaced_link_filter.rb              |  2 +-
 lib/banzai/filter/table_of_contents_filter.rb        |  2 +-
 lib/declarative_policy/preferred_scope.rb            |  1 -
 lib/gitlab.rb                                        |  4 ++--
 lib/gitlab/auth/result.rb                            |  1 -
 .../populate_untracked_uploads_dependencies.rb       |  4 ++--
 .../prepare_untracked_uploads.rb                     |  2 +-
 lib/gitlab/ci/build/artifacts/metadata.rb            |  4 ++--
 lib/gitlab/ci/pipeline/chain/command.rb              |  1 -
 lib/gitlab/ci/pipeline/chain/skip.rb                 |  2 +-
 lib/gitlab/content_disposition.rb                    |  4 ++--
 lib/gitlab/danger/helper.rb                          |  3 ---
 lib/gitlab/git/pre_receive_error.rb                  |  2 +-
 lib/gitlab/gitaly_client.rb                          |  2 +-
 lib/gitlab/github_import/representation/diff_note.rb |  2 +-
 lib/gitlab/github_import/representation/note.rb      |  2 +-
 lib/gitlab/health_checks/metric.rb                   |  1 -
 lib/gitlab/health_checks/result.rb                   |  1 -
 lib/gitlab/metrics/metric.rb                         |  2 +-
 lib/gitlab/middleware/read_only.rb                   |  2 +-
 lib/gitlab/middleware/release_env.rb                 |  1 -
 lib/gitlab/push_options.rb                           |  2 +-
 .../quick_actions/spend_time_and_date_separator.rb   |  2 +-
 lib/gitlab/sanitizers/svg.rb                         |  2 +-
 lib/gitlab/sherlock/middleware.rb                    |  4 ++--
 lib/gitlab/sherlock/query.rb                         |  2 +-
 lib/gitlab/slash_commands/result.rb                  |  1 -
 lib/gitlab/sql/pattern.rb                            |  2 +-
 lib/gitlab/user_extractor.rb                         |  2 +-
 lib/haml_lint/inline_javascript.rb                   |  1 -
 lib/tasks/gemojione.rake                             |  2 +-
 35 files changed, 40 insertions(+), 51 deletions(-)

(limited to 'lib')

diff --git a/lib/api/api.rb b/lib/api/api.rb
index a572cca24e9..f4a96b9711b 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -6,7 +6,7 @@ module API
 
     LOG_FILENAME = Rails.root.join("log", "api_json.log")
 
-    NO_SLASH_URL_PART_REGEX = %r{[^/]+}
+    NO_SLASH_URL_PART_REGEX = %r{[^/]+}.freeze
     NAMESPACE_OR_PROJECT_REQUIREMENTS = { id: NO_SLASH_URL_PART_REGEX }.freeze
     COMMIT_ENDPOINT_REQUIREMENTS = NAMESPACE_OR_PROJECT_REQUIREMENTS.merge(sha: NO_SLASH_URL_PART_REGEX).freeze
     USER_REQUIREMENTS = { user_id: NO_SLASH_URL_PART_REGEX }.freeze
diff --git a/lib/banzai/color_parser.rb b/lib/banzai/color_parser.rb
index 6d01d51955c..cce79e73d2d 100644
--- a/lib/banzai/color_parser.rb
+++ b/lib/banzai/color_parser.rb
@@ -2,13 +2,13 @@
 
 module Banzai
   module ColorParser
-    ALPHA = /0(?:\.\d+)?|\.\d+|1(?:\.0+)?/ # 0.0..1.0
-    PERCENTS = /(?:\d{1,2}|100)%/ # 00%..100%
-    ALPHA_CHANNEL = /(?:,\s*(?:#{ALPHA}|#{PERCENTS}))?/
-    BITS = /\d{1,2}|1\d\d|2(?:[0-4]\d|5[0-5])/ # 00..255
-    DEGS = /-?\d+(?:deg)?/i # [-]digits[deg]
-    RADS = /-?(?:\d+(?:\.\d+)?|\.\d+)rad/i # [-](digits[.digits] OR .digits)rad
-    HEX_FORMAT = /\#(?:\h{3}|\h{4}|\h{6}|\h{8})/
+    ALPHA = /0(?:\.\d+)?|\.\d+|1(?:\.0+)?/.freeze # 0.0..1.0
+    PERCENTS = /(?:\d{1,2}|100)%/.freeze # 00%..100%
+    ALPHA_CHANNEL = /(?:,\s*(?:#{ALPHA}|#{PERCENTS}))?/.freeze
+    BITS = /\d{1,2}|1\d\d|2(?:[0-4]\d|5[0-5])/.freeze # 00..255
+    DEGS = /-?\d+(?:deg)?/i.freeze # [-]digits[deg]
+    RADS = /-?(?:\d+(?:\.\d+)?|\.\d+)rad/i.freeze # [-](digits[.digits] OR .digits)rad
+    HEX_FORMAT = /\#(?:\h{3}|\h{4}|\h{6}|\h{8})/.freeze
     RGB_FORMAT = %r{
       (?:rgba?
         \(
@@ -20,7 +20,7 @@ module Banzai
           #{ALPHA_CHANNEL}
         \)
       )
-    }xi
+    }xi.freeze
     HSL_FORMAT = %r{
       (?:hsla?
         \(
@@ -28,11 +28,11 @@ module Banzai
           #{ALPHA_CHANNEL}
         \)
       )
-    }xi
+    }xi.freeze
 
     FORMATS = [HEX_FORMAT, RGB_FORMAT, HSL_FORMAT].freeze
 
-    COLOR_FORMAT = /\A(#{Regexp.union(FORMATS)})\z/ix
+    COLOR_FORMAT = /\A(#{Regexp.union(FORMATS)})\z/ix.freeze
 
     # Public: Analyzes whether the String is a color code.
     #
diff --git a/lib/banzai/filter/autolink_filter.rb b/lib/banzai/filter/autolink_filter.rb
index 086adf59d2b..56214043d87 100644
--- a/lib/banzai/filter/autolink_filter.rb
+++ b/lib/banzai/filter/autolink_filter.rb
@@ -33,7 +33,7 @@ module Banzai
       # https://github.com/vmg/rinku/blob/v2.0.1/ext/rinku/autolink.c#L65
       #
       # Rubular: http://rubular.com/r/nrL3r9yUiq
-      LINK_PATTERN = %r{([a-z][a-z0-9\+\.-]+://[^\s>]+)(?<!\?|!|\.|,|:)}
+      LINK_PATTERN = %r{([a-z][a-z0-9\+\.-]+://[^\s>]+)(?<!\?|!|\.|,|:)}.freeze
 
       # Text matching LINK_PATTERN inside these elements will not be linked
       IGNORE_PARENTS = %w(a code kbd pre script style).to_set
diff --git a/lib/banzai/filter/front_matter_filter.rb b/lib/banzai/filter/front_matter_filter.rb
index a27d18facd1..544231adea4 100644
--- a/lib/banzai/filter/front_matter_filter.rb
+++ b/lib/banzai/filter/front_matter_filter.rb
@@ -20,7 +20,7 @@ module Banzai
         \s*
         ^\k<delim>                             # closing front matter marker
         \s*
-      }mx
+      }mx.freeze
 
       def call
         html.sub(PATTERN) do |_match|
diff --git a/lib/banzai/filter/spaced_link_filter.rb b/lib/banzai/filter/spaced_link_filter.rb
index 50bf823929c..ee7f10ebdf6 100644
--- a/lib/banzai/filter/spaced_link_filter.rb
+++ b/lib/banzai/filter/spaced_link_filter.rb
@@ -33,7 +33,7 @@ module Banzai
           (?<new_link>.+?)
           (?<title>\ ".+?")?
         \)
-      }x
+      }x.freeze
 
       # Text matching LINK_OR_IMAGE_PATTERN inside these elements will not be linked
       IGNORE_PARENTS = %w(a code kbd pre script style).to_set
diff --git a/lib/banzai/filter/table_of_contents_filter.rb b/lib/banzai/filter/table_of_contents_filter.rb
index f2ae17b44fa..1a68d773048 100644
--- a/lib/banzai/filter/table_of_contents_filter.rb
+++ b/lib/banzai/filter/table_of_contents_filter.rb
@@ -17,7 +17,7 @@ module Banzai
     #   :toc - String containing Table of Contents data as a `ul` element with
     #          `li` child elements.
     class TableOfContentsFilter < HTML::Pipeline::Filter
-      PUNCTUATION_REGEXP = /[^\p{Word}\- ]/u
+      PUNCTUATION_REGEXP = /[^\p{Word}\- ]/u.freeze
 
       def call
         return doc if context[:no_header_anchors]
diff --git a/lib/declarative_policy/preferred_scope.rb b/lib/declarative_policy/preferred_scope.rb
index 239780d8626..9b7d1548056 100644
--- a/lib/declarative_policy/preferred_scope.rb
+++ b/lib/declarative_policy/preferred_scope.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 module DeclarativePolicy
diff --git a/lib/gitlab.rb b/lib/gitlab.rb
index 1204e53ee2e..d301efc3205 100644
--- a/lib/gitlab.rb
+++ b/lib/gitlab.rb
@@ -36,8 +36,8 @@ module Gitlab
   end
 
   COM_URL = 'https://gitlab.com'.freeze
-  APP_DIRS_PATTERN = %r{^/?(app|config|ee|lib|spec|\(\w*\))}
-  SUBDOMAIN_REGEX = %r{\Ahttps://[a-z0-9]+\.gitlab\.com\z}
+  APP_DIRS_PATTERN = %r{^/?(app|config|ee|lib|spec|\(\w*\))}.freeze
+  SUBDOMAIN_REGEX = %r{\Ahttps://[a-z0-9]+\.gitlab\.com\z}.freeze
   VERSION = File.read(root.join("VERSION")).strip.freeze
   INSTALLATION_TYPE = File.read(root.join("INSTALLATION_TYPE")).strip.freeze
 
diff --git a/lib/gitlab/auth/result.rb b/lib/gitlab/auth/result.rb
index 78fa25c5516..4ebf2afb9cb 100644
--- a/lib/gitlab/auth/result.rb
+++ b/lib/gitlab/auth/result.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 module Gitlab
diff --git a/lib/gitlab/background_migration/populate_untracked_uploads_dependencies.rb b/lib/gitlab/background_migration/populate_untracked_uploads_dependencies.rb
index a84f794bfae..1924f2ffee2 100644
--- a/lib/gitlab/background_migration/populate_untracked_uploads_dependencies.rb
+++ b/lib/gitlab/background_migration/populate_untracked_uploads_dependencies.rb
@@ -8,8 +8,8 @@ module Gitlab
         self.table_name = 'untracked_files_for_uploads'
 
         # Ends with /:random_hex/:filename
-        FILE_UPLOADER_PATH = %r{/\h+/[^/]+\z}
-        FULL_PATH_CAPTURE = /\A(.+)#{FILE_UPLOADER_PATH}/
+        FILE_UPLOADER_PATH = %r{/\h+/[^/]+\z}.freeze
+        FULL_PATH_CAPTURE = /\A(.+)#{FILE_UPLOADER_PATH}/.freeze
 
         # These regex patterns are tested against a relative path, relative to
         # the upload directory.
diff --git a/lib/gitlab/background_migration/prepare_untracked_uploads.rb b/lib/gitlab/background_migration/prepare_untracked_uploads.rb
index 81ca2b0a9b7..1ee44a3a5a9 100644
--- a/lib/gitlab/background_migration/prepare_untracked_uploads.rb
+++ b/lib/gitlab/background_migration/prepare_untracked_uploads.rb
@@ -16,7 +16,7 @@ module Gitlab
         RELATIVE_UPLOAD_DIR
       )
       FOLLOW_UP_MIGRATION = 'PopulateUntrackedUploads'.freeze
-      START_WITH_ROOT_REGEX = %r{\A#{Gitlab.config.uploads.storage_path}/}
+      START_WITH_ROOT_REGEX = %r{\A#{Gitlab.config.uploads.storage_path}/}.freeze
       EXCLUDED_HASHED_UPLOADS_PATH = "#{ABSOLUTE_UPLOAD_DIR}/@hashed/*".freeze
       EXCLUDED_TMP_UPLOADS_PATH = "#{ABSOLUTE_UPLOAD_DIR}/tmp/*".freeze
 
diff --git a/lib/gitlab/ci/build/artifacts/metadata.rb b/lib/gitlab/ci/build/artifacts/metadata.rb
index 7011dd1aaf2..1c3ce08be76 100644
--- a/lib/gitlab/ci/build/artifacts/metadata.rb
+++ b/lib/gitlab/ci/build/artifacts/metadata.rb
@@ -11,8 +11,8 @@ module Gitlab
           ParserError = Class.new(StandardError)
           InvalidStreamError = Class.new(StandardError)
 
-          VERSION_PATTERN = /^[\w\s]+(\d+\.\d+\.\d+)/
-          INVALID_PATH_PATTERN = %r{(^\.?\.?/)|(/\.?\.?/)}
+          VERSION_PATTERN = /^[\w\s]+(\d+\.\d+\.\d+)/.freeze
+          INVALID_PATH_PATTERN = %r{(^\.?\.?/)|(/\.?\.?/)}.freeze
 
           attr_reader :stream, :path, :full_version
 
diff --git a/lib/gitlab/ci/pipeline/chain/command.rb b/lib/gitlab/ci/pipeline/chain/command.rb
index 03af99ba9a5..c911bfa7ff6 100644
--- a/lib/gitlab/ci/pipeline/chain/command.rb
+++ b/lib/gitlab/ci/pipeline/chain/command.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 module Gitlab
diff --git a/lib/gitlab/ci/pipeline/chain/skip.rb b/lib/gitlab/ci/pipeline/chain/skip.rb
index 7d6e0704d4a..df92e229f12 100644
--- a/lib/gitlab/ci/pipeline/chain/skip.rb
+++ b/lib/gitlab/ci/pipeline/chain/skip.rb
@@ -7,7 +7,7 @@ module Gitlab
         class Skip < Chain::Base
           include ::Gitlab::Utils::StrongMemoize
 
-          SKIP_PATTERN = /\[(ci[ _-]skip|skip[ _-]ci)\]/i
+          SKIP_PATTERN = /\[(ci[ _-]skip|skip[ _-]ci)\]/i.freeze
 
           def perform!
             if skipped?
diff --git a/lib/gitlab/content_disposition.rb b/lib/gitlab/content_disposition.rb
index 32207514ce5..ff6154a5b26 100644
--- a/lib/gitlab/content_disposition.rb
+++ b/lib/gitlab/content_disposition.rb
@@ -22,13 +22,13 @@ module Gitlab
     end
 
     # rubocop:disable Style/VariableInterpolation
-    TRADITIONAL_ESCAPED_CHAR = /[^ A-Za-z0-9!#$+.^_`|~-]/
+    TRADITIONAL_ESCAPED_CHAR = /[^ A-Za-z0-9!#$+.^_`|~-]/.freeze
 
     def ascii_filename
       'filename="' + percent_escape(::I18n.transliterate(filename), TRADITIONAL_ESCAPED_CHAR) + '"'
     end
 
-    RFC_5987_ESCAPED_CHAR = /[^A-Za-z0-9!#$&+.^_`|~-]/
+    RFC_5987_ESCAPED_CHAR = /[^A-Za-z0-9!#$&+.^_`|~-]/.freeze
     # rubocop:enable Style/VariableInterpolation
 
     def utf8_filename
diff --git a/lib/gitlab/danger/helper.rb b/lib/gitlab/danger/helper.rb
index 68890aa8e30..3ef19d801b7 100644
--- a/lib/gitlab/danger/helper.rb
+++ b/lib/gitlab/danger/helper.rb
@@ -103,8 +103,6 @@ module Gitlab
         none: "",
         qa: "~QA"
       }.freeze
-
-      # rubocop:disable Style/RegexpLiteral
       CATEGORIES = {
         %r{\Adoc/} => :none, # To reinstate roulette for documentation, set to `:docs`.
         %r{\A(CONTRIBUTING|LICENSE|MAINTENANCE|PHILOSOPHY|PROCESS|README)(\.md)?\z} => :none, # To reinstate roulette for documentation, set to `:docs`.
@@ -151,7 +149,6 @@ module Gitlab
         %r{\.(md|txt)\z} => :none, # To reinstate roulette for documentation, set to `:docs`.
         %r{\.js\z} => :frontend
       }.freeze
-      # rubocop:enable Style/RegexpLiteral
     end
   end
 end
diff --git a/lib/gitlab/git/pre_receive_error.rb b/lib/gitlab/git/pre_receive_error.rb
index b46d4ba0b02..ef9b1bf5224 100644
--- a/lib/gitlab/git/pre_receive_error.rb
+++ b/lib/gitlab/git/pre_receive_error.rb
@@ -14,7 +14,7 @@ module Gitlab
         'GL-HOOK-ERR:' # Messages marked as safe by user
       ].freeze
 
-      SAFE_MESSAGE_REGEX = /^(#{SAFE_MESSAGE_PREFIXES.join('|')})\s*(?<safe_message>.+)/
+      SAFE_MESSAGE_REGEX = /^(#{SAFE_MESSAGE_PREFIXES.join('|')})\s*(?<safe_message>.+)/.freeze
 
       def initialize(message = '')
         super(sanitize(message))
diff --git a/lib/gitlab/gitaly_client.rb b/lib/gitlab/gitaly_client.rb
index d34b50c5215..4908f236cd1 100644
--- a/lib/gitlab/gitaly_client.rb
+++ b/lib/gitlab/gitaly_client.rb
@@ -26,7 +26,7 @@ module Gitlab
       end
     end
 
-    PEM_REGEX = /\-+BEGIN CERTIFICATE\-+.+?\-+END CERTIFICATE\-+/m
+    PEM_REGEX = /\-+BEGIN CERTIFICATE\-+.+?\-+END CERTIFICATE\-+/m.freeze
     SERVER_VERSION_FILE = 'GITALY_SERVER_VERSION'
     MAXIMUM_GITALY_CALLS = 30
     CLIENT_NAME = (Sidekiq.server? ? 'gitlab-sidekiq' : 'gitlab-web').freeze
diff --git a/lib/gitlab/github_import/representation/diff_note.rb b/lib/gitlab/github_import/representation/diff_note.rb
index be1334ca98a..d336b1ba797 100644
--- a/lib/gitlab/github_import/representation/diff_note.rb
+++ b/lib/gitlab/github_import/representation/diff_note.rb
@@ -13,7 +13,7 @@ module Gitlab
                          :diff_hunk, :author, :note, :created_at, :updated_at,
                          :github_id
 
-        NOTEABLE_ID_REGEX = %r{/pull/(?<iid>\d+)}i
+        NOTEABLE_ID_REGEX = %r{/pull/(?<iid>\d+)}i.freeze
 
         # Builds a diff note from a GitHub API response.
         #
diff --git a/lib/gitlab/github_import/representation/note.rb b/lib/gitlab/github_import/representation/note.rb
index 070e3b2db8d..5b98ce7d5ed 100644
--- a/lib/gitlab/github_import/representation/note.rb
+++ b/lib/gitlab/github_import/representation/note.rb
@@ -12,7 +12,7 @@ module Gitlab
         expose_attribute :noteable_id, :noteable_type, :author, :note,
                          :created_at, :updated_at, :github_id
 
-        NOTEABLE_TYPE_REGEX = %r{/(?<type>(pull|issues))/(?<iid>\d+)}i
+        NOTEABLE_TYPE_REGEX = %r{/(?<type>(pull|issues))/(?<iid>\d+)}i.freeze
 
         # Builds a note from a GitHub API response.
         #
diff --git a/lib/gitlab/health_checks/metric.rb b/lib/gitlab/health_checks/metric.rb
index 62a5216d159..184083de2bc 100644
--- a/lib/gitlab/health_checks/metric.rb
+++ b/lib/gitlab/health_checks/metric.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 module Gitlab::HealthChecks
diff --git a/lib/gitlab/health_checks/result.rb b/lib/gitlab/health_checks/result.rb
index d32a6980eb8..4586b1d94a7 100644
--- a/lib/gitlab/health_checks/result.rb
+++ b/lib/gitlab/health_checks/result.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 module Gitlab::HealthChecks
diff --git a/lib/gitlab/metrics/metric.rb b/lib/gitlab/metrics/metric.rb
index 9e4d70a71ff..30f181542be 100644
--- a/lib/gitlab/metrics/metric.rb
+++ b/lib/gitlab/metrics/metric.rb
@@ -4,7 +4,7 @@ module Gitlab
   module Metrics
     # Class for storing details of a single metric (label, value, etc).
     class Metric
-      JITTER_RANGE = 0.000001..0.001
+      JITTER_RANGE = (0.000001..0.001).freeze
 
       attr_reader :series, :values, :tags, :type
 
diff --git a/lib/gitlab/middleware/read_only.rb b/lib/gitlab/middleware/read_only.rb
index 83c52a6c6e0..8e17073abab 100644
--- a/lib/gitlab/middleware/read_only.rb
+++ b/lib/gitlab/middleware/read_only.rb
@@ -3,7 +3,7 @@
 module Gitlab
   module Middleware
     class ReadOnly
-      API_VERSIONS = (3..4)
+      API_VERSIONS = (3..4).freeze
 
       def self.internal_routes
         @internal_routes ||=
diff --git a/lib/gitlab/middleware/release_env.rb b/lib/gitlab/middleware/release_env.rb
index 849cf8f759b..0719fb2e8c6 100644
--- a/lib/gitlab/middleware/release_env.rb
+++ b/lib/gitlab/middleware/release_env.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 module Gitlab
diff --git a/lib/gitlab/push_options.rb b/lib/gitlab/push_options.rb
index 810aba436cc..3137676ba4b 100644
--- a/lib/gitlab/push_options.rb
+++ b/lib/gitlab/push_options.rb
@@ -15,7 +15,7 @@ module Gitlab
       mr: :merge_request
     }).freeze
 
-    OPTION_MATCHER = /(?<namespace>[^\.]+)\.(?<key>[^=]+)=?(?<value>.*)/
+    OPTION_MATCHER = /(?<namespace>[^\.]+)\.(?<key>[^=]+)=?(?<value>.*)/.freeze
 
     attr_reader :options
 
diff --git a/lib/gitlab/quick_actions/spend_time_and_date_separator.rb b/lib/gitlab/quick_actions/spend_time_and_date_separator.rb
index f5176376a60..4a62e83e8e9 100644
--- a/lib/gitlab/quick_actions/spend_time_and_date_separator.rb
+++ b/lib/gitlab/quick_actions/spend_time_and_date_separator.rb
@@ -11,7 +11,7 @@ module Gitlab
     # if date doesn't present return time with current date
     # in other cases return nil
     class SpendTimeAndDateSeparator
-      DATE_REGEX = %r{(\d{2,4}[/\-.]\d{1,2}[/\-.]\d{1,2})}
+      DATE_REGEX = %r{(\d{2,4}[/\-.]\d{1,2}[/\-.]\d{1,2})}.freeze
 
       def initialize(spend_command_arg)
         @spend_arg = spend_command_arg
diff --git a/lib/gitlab/sanitizers/svg.rb b/lib/gitlab/sanitizers/svg.rb
index 0d4e6be2129..98f78c5e74b 100644
--- a/lib/gitlab/sanitizers/svg.rb
+++ b/lib/gitlab/sanitizers/svg.rb
@@ -9,7 +9,7 @@ module Gitlab
 
       class Scrubber < Loofah::Scrubber
         # http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#embedding-custom-non-visible-data-with-the-data-*-attributes
-        DATA_ATTR_PATTERN = /\Adata-(?!xml)[a-z_][\w.\u00E0-\u00F6\u00F8-\u017F\u01DD-\u02AF-]*\z/u
+        DATA_ATTR_PATTERN = /\Adata-(?!xml)[a-z_][\w.\u00E0-\u00F6\u00F8-\u017F\u01DD-\u02AF-]*\z/u.freeze
 
         def scrub(node)
           unless Whitelist::ALLOWED_ELEMENTS.include?(node.name)
diff --git a/lib/gitlab/sherlock/middleware.rb b/lib/gitlab/sherlock/middleware.rb
index 747cb0f9142..f7b08d58e49 100644
--- a/lib/gitlab/sherlock/middleware.rb
+++ b/lib/gitlab/sherlock/middleware.rb
@@ -4,9 +4,9 @@ module Gitlab
   module Sherlock
     # Rack middleware used for tracking request metrics.
     class Middleware
-      CONTENT_TYPES = %r{text/html|application/json}i
+      CONTENT_TYPES = %r{text/html|application/json}i.freeze
 
-      IGNORE_PATHS = %r{^/sherlock}
+      IGNORE_PATHS = %r{^/sherlock}.freeze
 
       def initialize(app)
         @app = app
diff --git a/lib/gitlab/sherlock/query.rb b/lib/gitlab/sherlock/query.rb
index 11561eec32a..159ce27e702 100644
--- a/lib/gitlab/sherlock/query.rb
+++ b/lib/gitlab/sherlock/query.rb
@@ -15,7 +15,7 @@ module Gitlab
           |GROUP\s+BY
           |ORDER\s+BY
           |LIMIT
-          |OFFSET)\s+}ix # Vim indent breaks when this is on a newline :<
+          |OFFSET)\s+}ix.freeze # Vim indent breaks when this is on a newline :<
 
       # Creates a new Query using a String and a separate Array of bindings.
       #
diff --git a/lib/gitlab/slash_commands/result.rb b/lib/gitlab/slash_commands/result.rb
index 607c9c8dec1..a66a2e0726b 100644
--- a/lib/gitlab/slash_commands/result.rb
+++ b/lib/gitlab/slash_commands/result.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 module Gitlab
diff --git a/lib/gitlab/sql/pattern.rb b/lib/gitlab/sql/pattern.rb
index b698391c8bd..fd108b4c124 100644
--- a/lib/gitlab/sql/pattern.rb
+++ b/lib/gitlab/sql/pattern.rb
@@ -6,7 +6,7 @@ module Gitlab
       extend ActiveSupport::Concern
 
       MIN_CHARS_FOR_PARTIAL_MATCHING = 3
-      REGEX_QUOTED_WORD = /(?<=\A| )"[^"]+"(?= |\z)/
+      REGEX_QUOTED_WORD = /(?<=\A| )"[^"]+"(?= |\z)/.freeze
 
       class_methods do
         def fuzzy_search(query, columns)
diff --git a/lib/gitlab/user_extractor.rb b/lib/gitlab/user_extractor.rb
index f0557f6ad68..ede60c9ab1d 100644
--- a/lib/gitlab/user_extractor.rb
+++ b/lib/gitlab/user_extractor.rb
@@ -7,7 +7,7 @@ module Gitlab
   class UserExtractor
     # Not using `Devise.email_regexp` to filter out any chars that an email
     # does not end with and not pinning the email to a start of end of a string.
-    EMAIL_REGEXP = /(?<email>([^@\s]+@[^@\s]+(?<!\W)))/
+    EMAIL_REGEXP = /(?<email>([^@\s]+@[^@\s]+(?<!\W)))/.freeze
     USERNAME_REGEXP = User.reference_pattern
 
     def initialize(text)
diff --git a/lib/haml_lint/inline_javascript.rb b/lib/haml_lint/inline_javascript.rb
index 2e98227a05e..1b17162f71d 100644
--- a/lib/haml_lint/inline_javascript.rb
+++ b/lib/haml_lint/inline_javascript.rb
@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 unless Rails.env.production?
diff --git a/lib/tasks/gemojione.rake b/lib/tasks/gemojione.rake
index 560a52053d8..8cf7c9e89f0 100644
--- a/lib/tasks/gemojione.rake
+++ b/lib/tasks/gemojione.rake
@@ -209,7 +209,7 @@ namespace :gemojione do
     image.destroy!
   end
 
-  EMOJI_IMAGE_PATH_RE = /(.*?)(([0-9a-f]-?)+)\.png$/i
+  EMOJI_IMAGE_PATH_RE = /(.*?)(([0-9a-f]-?)+)\.png$/i.freeze
   def rename_to_named_emoji_image!(emoji_unicode_string_to_name_map, image_path)
     # Rename file from unicode to emoji name
     matches = EMOJI_IMAGE_PATH_RE.match(image_path)
-- 
cgit v1.2.1