Commit f82d549d authored by Timothy Andrew's avatar Timothy Andrew
Browse files

Accept environment variables from the `pre-receive` script. 

1. Starting version 2.11, git changed the way the pre-receive flow works.

  - Previously, the new potential objects would be added to the main repo. If the
    pre-receive passes, the new objects stay in the repo but are linked up. If
    the pre-receive fails, the new objects stay orphaned in the repo, and are
    cleaned up during the next `git gc`.

  - In 2.11, the new potential objects are added to a temporary "alternate object
    directory", that git creates for this purpose. If the pre-receive passes, the
    objects from the alternate object directory are migrated to the main repo. If
    the pre-receive fails the alternate object directory is simply deleted.

2. In our workflow, the pre-recieve script (in `gitlab-shell) calls the
   `/allowed` endpoint, which calls out directly to git to perform
   various checks. These direct calls to git do _not_ have the necessary
   environment variables set which allow access to the "alternate object
   directory" (explained above). Therefore these calls to git are not able to
   access any of the new potential objects to be added during this push.

3. We fix this by accepting the relevant environment variables
   (GIT_ALTERNATE_OBJECT_DIRECTORIES, GIT_OBJECT_DIRECTORY) on the
   `/allowed` endpoint, and then include these environment variables while
   calling out to git.

4. This commit includes (whitelisted) these environment variables while making
   the "force push" check. A `Gitlab::Git::RevList` module is extracted to
   prevent `ForcePush` from being littered with these checks.
parent ca6bf62e

lib/api/helpers/internal_helpers.rb

+8 −0
Original line number Diff line number Diff line
@@ -52,6 +52,14 @@ def ssh_authentication_abilities 
          :push_code

        ]

      end



      def parse_allowed_environment_variables

        return if params[:env].blank?



        JSON.parse(params[:env])



      rescue JSON::ParserError

      end

    end

  end

end

lib/api/internal.rb

+5 −1
Original line number Diff line number Diff line
@@ -32,7 +32,11 @@ class Internal < Grape::API 
          if wiki?

            Gitlab::GitAccessWiki.new(actor, project, protocol, authentication_abilities: ssh_authentication_abilities)

          else

            Gitlab::GitAccess.new(actor, project, protocol, authentication_abilities: ssh_authentication_abilities)

            Gitlab::GitAccess.new(actor,

                                  project,

                                  protocol,

                                  authentication_abilities: ssh_authentication_abilities,

                                  env: parse_allowed_environment_variables)

          end



        access_status = access.check(params[:action], params[:changes])

lib/gitlab/checks/change_access.rb

+3 −2
Original line number Diff line number Diff line
@@ -3,11 +3,12 @@ module Checks 
    class ChangeAccess

      attr_reader :user_access, :project



      def initialize(change, user_access:, project:)

      def initialize(change, user_access:, project:, env: {})

        @oldrev, @newrev, @ref = change.values_at(:oldrev, :newrev, :ref)

        @branch_name = Gitlab::Git.branch_name(@ref)

        @user_access = user_access

        @project = project

        @env = env

      end



      def exec
@@ -68,7 +69,7 @@ def protected_tag?(tag_name) 
      end



      def forced_push?

        Gitlab::Checks::ForcePush.force_push?(@project, @oldrev, @newrev)

        Gitlab::Checks::ForcePush.force_push?(@project, @oldrev, @newrev, env: @env)

      end



      def matching_merge_request?

lib/gitlab/checks/force_push.rb

+2 −2
Original line number Diff line number Diff line 
module Gitlab

  module Checks

    class ForcePush

      def self.force_push?(project, oldrev, newrev)

      def self.force_push?(project, oldrev, newrev, env: {})

        return false if project.empty_repo?



        # Created or deleted branch

        if Gitlab::Git.blank_ref?(oldrev) || Gitlab::Git.blank_ref?(newrev)

          false

        else

          missed_ref, _ = Gitlab::Popen.popen(%W(#{Gitlab.config.git.bin_path} --git-dir=#{project.repository.path_to_repo} rev-list --max-count=1 #{oldrev} ^#{newrev}))

          missed_ref, _ = Gitlab::Git::RevList.new(oldrev, newrev, project: project, env: env).execute

          missed_ref.present?

        end

      end

lib/gitlab/git/rev_list.rb

0 → 100644
+28 −0
Original line number Diff line number Diff line 
# Call out to the `git rev-list` command



module Gitlab

  module Git

    class RevList

      def initialize(oldrev, newrev, project:, env: nil)

        @args = [Gitlab.config.git.bin_path,

                 "--git-dir=#{project.repository.path_to_repo}",

                 "rev-list",

                 "--max-count=1",

                 oldrev,

                 "^#{newrev}"]



        @env = env.slice(*allowed_environment_variables)

      end



      def execute

        Gitlab::Popen.popen(@args, nil, @env.slice(*allowed_environment_variables))

      end



      private



      def allowed_environment_variables

        %w(GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_OBJECT_DIRECTORY)

      end

    end

  end

end