gitlab-org--gitlab-foss/spec/models
Sean McGivern f5576b16ba Merge branch 'namespace-validation-fixes' into 'master'
Correct namespace validation to forbid bad names #21077

## What does this MR do?
Updates master namespace regex to forbid any namespace ending in `.git` or `.atom` and corrects and adds relevant tests

## Are there points in the code the reviewer needs to double check?
I think it's all good. I could use help with the creation of tests for usernames with trailing `.atom` or `.git` as the testing framework is a bit over my head.

## Why was this MR needed?
A group that ends in `.atom` will cause the relevent dashboard to crash if the user (ANY user, not just the creator) has visibility of the group until it is deleted through the admin panel (it cannot be renamed, the edit page will crash. It may be fixable through the API, that wasn't checked.)

This allows a malicious user with group creation privileges to bulk add users to a group, rename the group to a bad name, and crash the groups dashboard for all members of the group. The same applies if the group is internal or public and users navigate to the explore tab of the groups dashboard.

The same applies to usernames ending in `.atom`.

In many places of the code, it implies that `.git` in not allowed at the end of namespaces, but many allowed it anyway. This MR forbids it everywhere to prevent potential issues (like the one with `.atom` going forward).

## What are the relevant issue numbers?
Group path validation incomplete, crashes groups dashboard #21077

## Does this MR meet the acceptance criteria?

- [X] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [X] Added for this feature/bug
  - [X] All builds are passing
- [X] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [X] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [X] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !5994
2016-10-10 13:39:39 +00:00
..
ci Fix build. 2016-09-21 02:59:17 +05:30
concerns Add markdown cache columns to the database, but don't use them yet 2016-10-07 02:54:25 +01:00
cycle_analytics Fix the "Commits" section of the cycle analytics summary. 2016-09-26 18:38:40 +05:30
hooks Remove schema annotations completely 2016-09-16 14:37:48 +03:00
issue Fix spec failures. 2016-09-20 16:53:12 +05:30
members Allow Member.add_user to handle access requesters 2016-09-28 09:43:00 +02:00
merge_request Fix spec failures. 2016-09-20 16:53:12 +05:30
network Fix Error 500 resulting when loading network graph 2016-08-20 09:57:20 -07:00
project_services Merge branch 'feature/improve-async-pipeline-processing' into 'master' 2016-10-06 08:42:35 +00:00
ability_spec.rb Project tools visibility level 2016-09-01 11:47:59 -03:00
abuse_report_spec.rb Add markdown cache columns to the database, but don't use them yet 2016-10-07 02:54:25 +01:00
appearance_spec.rb
application_setting_spec.rb adds second batch of tests changed to active tense 2016-08-09 15:11:39 +01:00
award_emoji_spec.rb
blob_spec.rb Handle encoding in non-binary Blob instances 2016-09-14 14:15:31 +02:00
board_spec.rb The lists: Backlog, and Done cannot be destroyed 2016-08-17 12:58:57 -03:00
broadcast_message_spec.rb Now we already included it in spec_helper.rb 2016-08-20 00:11:03 +08:00
build_spec.rb Rename ignored to failed_but_allowed, introduce exclude_ignored 2016-10-03 18:22:51 +08:00
commit_range_spec.rb Use JavaScript tooltips for mentions (!5301) 2016-09-01 01:21:34 +02:00
commit_spec.rb Expand commit message width in repo view 2016-08-02 11:40:44 -05:00
commit_status_spec.rb Add test for CommitStatus.exclude_ignored 2016-10-03 18:56:32 +08:00
compare_spec.rb switch from diff_file_collection to diffs 2016-08-03 07:00:20 +02:00
deploy_key_spec.rb
deploy_keys_project_spec.rb
deployment_spec.rb Method names changed to #includes_commit? 2016-08-12 10:43:04 +02:00
diff_note_spec.rb Optimize discussion notes resolving and unresolving 2016-09-06 12:14:09 -03:00
discussion_spec.rb Optimize discussion notes resolving and unresolving 2016-09-06 12:14:09 -03:00
email_spec.rb
environment_spec.rb Fix validation regexs (+1 squashed commit) 2016-09-19 10:07:15 +02:00
event_spec.rb Remove lease from Event#reset_project_activity 2016-10-04 19:41:37 +02:00
external_issue_spec.rb
forked_project_link_spec.rb Enforce the fork_project permission in Projects::CreateService 2016-09-27 13:17:56 +01:00
generic_commit_status_spec.rb
global_milestone_spec.rb Ensure milestones passed to GlobalMilestone is an ActiveRecord::Relation 2016-09-23 13:34:39 +02:00
group_spec.rb Re-add the AccessRequestable concern 2016-09-22 11:12:17 +02:00
identity_spec.rb
issue_spec.rb Allow Member.add_user to handle access requesters 2016-09-28 09:43:00 +02:00
key_spec.rb adds second batch of tests changed to active tense 2016-08-09 15:11:39 +01:00
label_link_spec.rb
label_spec.rb Destroy related lists when a label is removed 2016-08-17 12:58:58 -03:00
legacy_diff_note_spec.rb Store discussion_id on Note for faster discussion lookup. 2016-08-17 12:16:46 -05:00
list_spec.rb Add a movable scope and a movable? method to List model 2016-08-17 12:58:59 -03:00
member_spec.rb Members::RequestAccessService is tricter on permissions 2016-10-03 10:06:40 +02:00
merge_request_diff_spec.rb Add test for MergeRequestDiff#commits_sha, feedback: 2016-09-22 17:36:43 +08:00
merge_request_spec.rb Merge branch 'issue_22446' into 'master' 2016-10-04 11:27:47 +00:00
milestone_spec.rb Allowing ">" to be used for Milestone models's title and storing the value in db as unescaped. 2016-09-29 19:28:38 -07:00
namespace_spec.rb Correct namespace validation to forbid bad names #21077 2016-10-07 13:46:59 -05:00
note_spec.rb remove Ability.abilities 2016-08-30 11:35:06 -07:00
notification_setting_spec.rb
personal_access_token_spec.rb
project_feature_spec.rb Project tools visibility level 2016-09-01 11:47:59 -03:00
project_group_link_spec.rb
project_snippet_spec.rb
project_spec.rb Merge branch 'sh-fix-events-update-spec' into 'master' 2016-10-07 11:13:26 +00:00
project_team_spec.rb Fix specs that requires an access request 2016-09-22 11:12:17 +02:00
project_wiki_spec.rb
protected_branch_spec.rb
release_spec.rb
repository_spec.rb Make searching for commits case insensitive. 2016-10-10 10:11:46 +02:00
service_spec.rb Add markdown cache columns to the database, but don't use them yet 2016-10-07 02:54:25 +01:00
snippet_spec.rb Add markdown cache columns to the database, but don't use them yet 2016-10-07 02:54:25 +01:00
spam_log_spec.rb
todo_spec.rb
tree_spec.rb
user_agent_detail_spec.rb Further refactor and syntax fixes. 2016-08-15 17:20:57 -05:00
user_spec.rb Refactor Gitlab::Identifier 2016-10-05 12:40:17 +02:00
wiki_page_spec.rb adds second batch of tests changed to active tense 2016-08-09 15:11:39 +01:00