2020-01-29 18:08:47 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
|
|
|
module Spam
|
2020-04-21 15:21:10 +00:00
|
|
|
class SpamActionService
|
|
|
|
include SpamConstants
|
2020-01-29 18:08:47 +00:00
|
|
|
|
2021-06-21 12:07:45 +00:00
|
|
|
def initialize(spammable:, spam_params:, user:, action:)
|
2020-02-27 12:09:12 +00:00
|
|
|
@target = spammable
|
2021-06-21 12:07:45 +00:00
|
|
|
@spam_params = spam_params
|
2020-06-08 06:08:19 +00:00
|
|
|
@user = user
|
2021-01-27 09:09:01 +00:00
|
|
|
@action = action
|
|
|
|
end
|
2020-01-29 18:08:47 +00:00
|
|
|
|
2021-04-09 18:09:24 +00:00
|
|
|
# rubocop:disable Metrics/AbcSize
|
2021-06-21 12:07:45 +00:00
|
|
|
def execute
|
|
|
|
# If spam_params is passed as `nil`, no check will be performed. This is the easiest way to allow
|
|
|
|
# composed services which may not need to do spam checking to "opt out". For example, when
|
|
|
|
# MoveService is calling CreateService, spam checking is not necessary, as no new content is
|
|
|
|
# being created.
|
|
|
|
return ServiceResponse.success(message: 'Skipped spam check because spam_params was not present') unless spam_params
|
2020-01-29 18:08:47 +00:00
|
|
|
|
2021-06-21 12:07:45 +00:00
|
|
|
recaptcha_verified = Captcha::CaptchaVerificationService.new(spam_params: spam_params).execute
|
2021-01-27 09:09:01 +00:00
|
|
|
|
2020-01-29 18:08:47 +00:00
|
|
|
if recaptcha_verified
|
2021-04-09 18:09:24 +00:00
|
|
|
# If it's a request which is already verified through CAPTCHA,
|
2020-01-29 18:08:47 +00:00
|
|
|
# update the spam log accordingly.
|
2021-01-27 09:09:01 +00:00
|
|
|
SpamLog.verify_recaptcha!(user_id: user.id, id: spam_params.spam_log_id)
|
2021-04-09 18:09:24 +00:00
|
|
|
ServiceResponse.success(message: "CAPTCHA successfully verified")
|
2020-01-29 18:08:47 +00:00
|
|
|
else
|
2021-01-27 09:09:01 +00:00
|
|
|
return ServiceResponse.success(message: 'Skipped spam check because user was allowlisted') if allowlisted?(user)
|
2021-07-20 06:08:37 +00:00
|
|
|
return ServiceResponse.success(message: 'Skipped spam check because it was not required') unless check_for_spam?(user: user)
|
2020-04-21 15:21:10 +00:00
|
|
|
|
2021-06-21 12:07:45 +00:00
|
|
|
perform_spam_service_check
|
2021-04-09 18:09:24 +00:00
|
|
|
ServiceResponse.success(message: "Spam check performed. Check #{target.class.name} spammable model for any errors or CAPTCHA requirement")
|
2020-01-29 18:08:47 +00:00
|
|
|
end
|
|
|
|
end
|
2021-04-09 18:09:24 +00:00
|
|
|
# rubocop:enable Metrics/AbcSize
|
2020-01-29 18:08:47 +00:00
|
|
|
|
2020-04-21 15:21:10 +00:00
|
|
|
delegate :check_for_spam?, to: :target
|
|
|
|
|
2020-01-29 18:08:47 +00:00
|
|
|
private
|
|
|
|
|
2021-06-21 12:07:45 +00:00
|
|
|
attr_reader :user, :action, :target, :spam_params, :spam_log
|
2021-01-27 09:09:01 +00:00
|
|
|
|
|
|
|
##
|
|
|
|
# In order to be proceed to the spam check process, the target must be
|
|
|
|
# a dirty instance, which means it should be already assigned with the new
|
|
|
|
# attribute values.
|
|
|
|
def ensure_target_is_dirty
|
|
|
|
msg = "Target instance of #{target.class.name} must be dirty (must have changes to save)"
|
|
|
|
raise(msg) unless target.has_changes_to_save?
|
|
|
|
end
|
2020-06-08 06:08:19 +00:00
|
|
|
|
2020-05-06 12:09:36 +00:00
|
|
|
def allowlisted?(user)
|
2020-10-19 09:08:58 +00:00
|
|
|
user.try(:gitlab_employee?) || user.try(:gitlab_bot?) || user.try(:gitlab_service_user?)
|
2020-05-06 12:09:36 +00:00
|
|
|
end
|
|
|
|
|
2021-01-27 09:09:01 +00:00
|
|
|
##
|
|
|
|
# Performs the spam check using the spam verdict service, and modifies the target model
|
|
|
|
# accordingly based on the result.
|
2021-06-21 12:07:45 +00:00
|
|
|
def perform_spam_service_check
|
2021-01-27 09:09:01 +00:00
|
|
|
ensure_target_is_dirty
|
|
|
|
|
2020-04-21 15:21:10 +00:00
|
|
|
# since we can check for spam, and recaptcha is not verified,
|
|
|
|
# ask the SpamVerdictService what to do with the target.
|
|
|
|
spam_verdict_service.execute.tap do |result|
|
|
|
|
case result
|
2020-05-26 03:08:02 +00:00
|
|
|
when CONDITIONAL_ALLOW
|
|
|
|
# at the moment, this means "ask for reCAPTCHA"
|
2021-06-21 12:07:45 +00:00
|
|
|
create_spam_log
|
2020-01-29 18:08:47 +00:00
|
|
|
|
2020-04-21 15:21:10 +00:00
|
|
|
break if target.allow_possible_spam?
|
2020-01-29 18:08:47 +00:00
|
|
|
|
2020-04-21 15:21:10 +00:00
|
|
|
target.needs_recaptcha!
|
|
|
|
when DISALLOW
|
|
|
|
# TODO: remove `unless target.allow_possible_spam?` once this flag has been passed to `SpamVerdictService`
|
|
|
|
# https://gitlab.com/gitlab-org/gitlab/-/issues/214739
|
|
|
|
target.spam! unless target.allow_possible_spam?
|
2021-06-21 12:07:45 +00:00
|
|
|
create_spam_log
|
2021-05-01 00:10:00 +00:00
|
|
|
when BLOCK_USER
|
|
|
|
# TODO: improve BLOCK_USER handling, non-existent until now
|
|
|
|
# https://gitlab.com/gitlab-org/gitlab/-/issues/329666
|
|
|
|
target.spam! unless target.allow_possible_spam?
|
2021-06-21 12:07:45 +00:00
|
|
|
create_spam_log
|
2020-04-21 15:21:10 +00:00
|
|
|
when ALLOW
|
|
|
|
target.clear_spam_flags!
|
2021-05-07 00:10:27 +00:00
|
|
|
when NOOP
|
|
|
|
# spamcheck is not explicitly rendering a verdict & therefore can't make a decision
|
|
|
|
target.clear_spam_flags!
|
2020-04-21 15:21:10 +00:00
|
|
|
end
|
|
|
|
end
|
2020-01-29 18:08:47 +00:00
|
|
|
end
|
|
|
|
|
2021-06-21 12:07:45 +00:00
|
|
|
def create_spam_log
|
2020-01-29 18:08:47 +00:00
|
|
|
@spam_log = SpamLog.create!(
|
|
|
|
{
|
2021-07-20 06:08:37 +00:00
|
|
|
user_id: user.id,
|
2020-02-27 12:09:12 +00:00
|
|
|
title: target.spam_title,
|
|
|
|
description: target.spam_description,
|
2021-06-21 12:07:45 +00:00
|
|
|
source_ip: spam_params.ip_address,
|
|
|
|
user_agent: spam_params.user_agent,
|
2021-01-27 09:09:01 +00:00
|
|
|
noteable_type: noteable_type,
|
2021-06-21 12:07:45 +00:00
|
|
|
# Now, all requests are via the API, so hardcode it to true to simplify the logic and API
|
|
|
|
# of this service. See https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/2266
|
|
|
|
# for original introduction of `via_api` field.
|
|
|
|
# See discussion here about possibly deprecating this field:
|
|
|
|
# https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/2266#note_542527450
|
|
|
|
via_api: true
|
2020-01-29 18:08:47 +00:00
|
|
|
}
|
|
|
|
)
|
2020-04-21 15:21:10 +00:00
|
|
|
|
|
|
|
target.spam_log = spam_log
|
|
|
|
end
|
|
|
|
|
|
|
|
def spam_verdict_service
|
2021-01-27 09:09:01 +00:00
|
|
|
context = {
|
|
|
|
action: action,
|
|
|
|
target_type: noteable_type
|
|
|
|
}
|
|
|
|
|
2021-06-21 12:07:45 +00:00
|
|
|
options = {
|
|
|
|
ip_address: spam_params.ip_address,
|
|
|
|
user_agent: spam_params.user_agent,
|
|
|
|
referer: spam_params.referer
|
|
|
|
}
|
|
|
|
|
2020-04-21 15:21:10 +00:00
|
|
|
SpamVerdictService.new(target: target,
|
2020-06-08 06:08:19 +00:00
|
|
|
user: user,
|
|
|
|
options: options,
|
2021-01-27 09:09:01 +00:00
|
|
|
context: context)
|
2020-06-08 06:08:19 +00:00
|
|
|
end
|
|
|
|
|
2021-01-27 09:09:01 +00:00
|
|
|
def noteable_type
|
2020-06-08 06:08:19 +00:00
|
|
|
@notable_type ||= target.class.to_s
|
2020-01-29 18:08:47 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|