Commit Graph

23 Commits

Author SHA1 Message Date
George Koltsov 8abf920d1f Refactor SystemHookUrlValidator and specs
Simplify SystemHookUrlValidator to inherit from PublicUrlValidator
Refactor specs to move out shared examples to be used in both
system hooks and public url validators.
2019-08-02 15:39:18 +01:00
George Koltsov ac7661924e Update security/webhooks.md doc page & specs
Updating security/webhooks.md to match new behaviour
as well as drying up few specs to extract shared
examples
2019-08-02 15:39:18 +01:00
George Koltsov e5e1c907c0 Add outbound requests setting for system hooks
This MR adds new application setting to network section
`allow_local_requests_from_system_hooks`. Prior to this change
system hooks were allowed to do local network requests by default
and we are adding an ability for admins to control it.
2019-08-02 15:39:18 +01:00
Douwe Maan a9bcddee4c Protect Gitlab::HTTP against DNS rebinding attack
Gitlab::HTTP now resolves the hostname only once, verifies the IP is not
blocked, and then uses the same IP to perform the actual request, while
passing the original hostname in the `Host` header and SSL SNI field.
2019-05-30 10:47:31 -03:00
Thong Kuah 85b29c1c2f Add frozen_string_literal to spec/services
Probably useful as we often move these files to "new" files.
2019-04-12 10:14:54 +12:00
Stan Hu c220f30081 Fix WebHookService spec failing in Ruby 2.6
Ruby 2.6 changed Net::ReadTimeout#message to include the reason for the
socket error (https://bugs.ruby-lang.org/issues/14832). However,
WebHookService was failing in Ruby 2.6 because it expected
Exception#message to match Exception#to_s, which isn't always the
case. Fix this by just checking Exception#to_s.
2019-02-16 14:42:25 -08:00
Rémy Coutable 3a2abc1d50
Enable the Layout/ExtraSpacing cop
Signed-off-by: Rémy Coutable <remy@rymai.me>
2019-01-24 13:05:45 +01:00
Heinrich Lee Yu 880792a04e Catch `RedirectionTooDeep` Exception in webhooks 2018-10-19 05:55:06 +00:00
Jan Beckmann 1345968ea6 Resolve "WebHookService doesn't handle user info with nil passwords" 2018-06-25 14:44:29 +00:00
Douwe Maan 5d003f3d1d
Ensure web hook 'blocked URL' errors are stored in as web hook logs and properly surfaced to the user 2018-05-04 14:48:01 +02:00
Douwe Maan 95ced3bb5f Merge branch 'fj-15329-services-callbacks-ssrf' into 'security-10-6'
Server Side Request Forgery in Services and Web Hooks

See merge request gitlab/gitlabhq!2337
2018-03-21 14:39:21 +00:00
Douwe Maan 1e6ca3c41e Consistently schedule Sidekiq jobs 2017-12-05 11:59:39 +01:00
Rémy Coutable 9e20157528
Fix a wrong `X-Gitlab-Event` header when testing webhooks
Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-09-07 17:40:32 +02:00
Robert Speicher 4edfad9678 Enable Layout/TrailingWhitespace cop and auto-correct offenses 2017-08-15 13:44:37 -04:00
Robert Speicher c8b802471b Enable the RSpec/HookArgument cop and auto-correct offenses 2017-08-10 19:29:42 -04:00
Robert Speicher 72a7b30c9f Change all `:empty_project` to `:project` 2017-08-02 17:47:31 -04:00
Alexander Randa 0135d57b01 Fix encoding error for WebHook logging 2017-08-01 20:19:59 +03:00
Rémy Coutable ad6487cec8 Merge branch 'log_webhook_timeout' into 'master'
Log web hook execution timeout events

See merge request !13134
2017-07-28 15:06:15 +00:00
Alex Lossent a94e91a45b Log web hook execution timeout events
If a web hook HTTP request is sent but no response comes
within a certain time (10s by default), the hook execution fails
and will be retried. This commit makes such timeouts visible
in the web hook log, like connection timeouts already are.

Also log "no route to host" errors.
2017-07-27 15:02:25 +02:00
Rémy Coutable cddc5cacfb Use described_class when possible
Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-07-27 14:31:53 +02:00
Rémy Coutable ddccd24c13 Remove superfluous lib: true, type: redis, service: true, models: true, services: true, no_db: true, api: true
Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-07-27 14:31:53 +02:00
Alexander Randa e0ab5618a0 Wrong data type when testing webhooks 2017-07-20 15:12:06 +00:00
Alexander Randa 330789c23c Implement web hooks logging
* implemented logging of project and system web hooks
* implemented UI for user area (project hooks)
* implemented UI for admin area (system hooks)
* implemented retry of logged webhook
* NOT imeplemented log remover
2017-05-25 10:07:52 +03:00