.gitlab-ci.yml

@@ -16,6 +16,8 @@ stages:
 default:
   tags:
     - gitlab-org
+  # All jobs are interruptible by default
+  interruptible: true
 
 workflow:
   rules:

.gitlab/ci/rules.gitlab-ci.yml

@@ -16,6 +16,9 @@
 .if-master-refs: &if-master-refs
   if: '$CI_COMMIT_REF_NAME == "master"'
 
+.if-auto-deploy-branches: &if-auto-deploy-branches
+  if: '$CI_COMMIT_BRANCH =~ /^\d+-\d+-auto-deploy-\d+$/'
+
 .if-master-or-tag: &if-master-or-tag
   if: '$CI_COMMIT_REF_NAME == "master" || $CI_COMMIT_TAG'
 
@@ -509,6 +512,14 @@
       changes: *code-backstage-qa-patterns
       when: on_success
 
+.setup:rules:dont-interrupt-me:
+  rules:
+    - <<: *if-master-or-tag
+      when: on_success
+    - <<: *if-auto-deploy-branches
+      when: on_success
+    - when: manual
+
 .setup:rules:gitlab_git_test:
   rules:
     - <<: *if-default-refs

.gitlab/ci/setup.gitlab-ci.yml

@@ -23,6 +23,18 @@ cache gems:
     - .default-retry
   needs: []
 
+dont-interrupt-me:
+  extends: .setup:rules:dont-interrupt-me
+  stage: prepare
+  image: alpine:edge
+  interruptible: false
+  allow_failure: true
+  variables:
+    GIT_STRATEGY: none
+  dependencies: []
+  script:
+    - echo "This jobs makes sure this pipeline won't be interrupted! See https://docs.gitlab.com/ee/ci/yaml/#interruptible."
+
 gitlab_git_test:
   extends:
     - .minimal-job

.gitlab/issue_templates/Solution_validation

+<!--Please answer the below questions to the best of your ability.-->
+
+#### What's this issue all about? (Background and context)
+
+#### What hypotheses and/or assumptions do you have?
+
+#### What questions are you trying to answer?
+
+#### What research methodology do you intend to use?
+
+<!-- What needs to be answered to move work forward? If you have a completed Opportunity Canvas include a link.-->
+
+#### What persona, persona segment, or customer type experiences the problem most acutely?
+
+#### What business decisions will be made based on this information?
+
+#### What, if any, relevant prior research already exists?
+
+<!-- Have a look at our UXR_Insights repo: https://gitlab.com/gitlab-org/uxr_insights -->
+
+#### Who will be leading the research?
+
+#### What timescales do you have in mind for the research?
+
+#### Relevant links (problem validation issue, design issue, script, prototype, notes, etc.)
+
+<!-- #### TODO Checklist
+ Consider adding a checklist in order to keep track of what stage the research is up to. Some possible checklist templates are here:
+ https://about.gitlab.com/handbook/engineering/ux/ux-research-training/templates-resources-for-research-studies/#checklists
+ -->
+
+/label ~"workflow::solution validation"
\ No newline at end of file

.gitlab/merge_request_templates/Security Release.md

@@ -27,7 +27,7 @@ See [the general developer security release guidelines](https://gitlab.com/gitla
 
 ## Maintainer checklist
 - [ ] Correct milestone is applied and the title is matching across all backports
-- [ ] Assigned to `@gitlab-release-tools-bot` with passing CI pipelines
+- [ ] Assigned to `@gitlab-release-tools-bot` with passing CI pipelines and **when all backports including the MR targeting master are ready.**
 
 /label ~security
 

.rubocop.yml

@@ -204,7 +204,6 @@ Gitlab/DuplicateSpecLocation:
   Exclude:
     - ee/spec/helpers/auth_helper_spec.rb
     - ee/spec/lib/gitlab/gl_repository_spec.rb
-    - ee/spec/lib/gitlab/usage_data_spec.rb
     - ee/spec/models/namespace_spec.rb
     - ee/spec/models/note_spec.rb
     - ee/spec/serializers/environment_entity_spec.rb
@@ -214,8 +213,6 @@ Gitlab/DuplicateSpecLocation:
     - ee/spec/services/merge_requests/update_service_spec.rb
     - ee/spec/services/system_hooks_service_spec.rb
     - ee/spec/helpers/ee/auth_helper_spec.rb
-    - ee/spec/lib/ee/gitlab/gl_repository_spec.rb
-    - ee/spec/lib/ee/gitlab/usage_data_spec.rb
     - ee/spec/models/ee/namespace_spec.rb
     - ee/spec/models/ee/note_spec.rb
     - ee/spec/serializers/ee/environment_entity_spec.rb
@@ -328,13 +325,6 @@ RSpec/LeakyConstantDeclaration:
   Exclude:
     - 'spec/**/*.rb'
     - 'qa/spec/**/*.rb'
-    - 'ee/spec/lib/gitlab/geo/log_cursor/logger_spec.rb'
-    - 'ee/spec/lib/gitlab/geo/log_helpers_spec.rb'
-    - 'ee/spec/lib/gitlab/geo/replicator_spec.rb'
-    - 'ee/spec/mailers/emails/service_desk_spec.rb'
-    - 'ee/spec/migrations/remove_creations_in_gitlab_subscription_histories_spec.rb'
-    - 'ee/spec/migrations/set_resolved_state_on_vulnerabilities_spec.rb'
-    - 'ee/spec/models/repository_spec.rb'
     - 'ee/spec/presenters/security/vulnerable_project_presenter_spec.rb'
     - 'ee/spec/serializers/vulnerable_project_entity_spec.rb'
     - 'ee/spec/services/clusters/applications/check_upgrade_progress_service_spec.rb'
@@ -389,3 +379,42 @@ Style/FloatDivision:
 
 Cop/BanCatchThrow:
   Enabled: true
+
+Performance/ReadlinesEach:
+  Enabled: true
+
+# https://gitlab.com/gitlab-org/gitlab/-/issues/212541
+RSpec/RepeatedExample:
+  Exclude:
+    - 'spec/features/issues/filtered_search/filter_issues_spec.rb'
+    - 'spec/features/merge_request/user_posts_diff_notes_spec.rb'
+    - 'spec/features/projects/files/template_type_dropdown_spec.rb'
+    - 'spec/finders/environments_finder_spec.rb'
+    - 'spec/frontend/fixtures/merge_requests.rb'
+    - 'spec/graphql/gitlab_schema_spec.rb'
+    - 'spec/helpers/users_helper_spec.rb'
+    - 'spec/lib/banzai/filter/autolink_filter_spec.rb'
+    - 'spec/lib/banzai/filter/issuable_state_filter_spec.rb'
+    - 'spec/lib/gitlab/closing_issue_extractor_spec.rb'
+    - 'spec/lib/gitlab/danger/changelog_spec.rb'
+    - 'spec/lib/gitlab/git/blob_spec.rb'
+    - 'spec/lib/gitlab/import_export/project/relation_factory_spec.rb'
+    - 'spec/models/ability_spec.rb'
+    - 'spec/models/ci/build_spec.rb'
+    - 'spec/models/concerns/issuable_spec.rb'
+    - 'spec/models/concerns/prometheus_adapter_spec.rb'
+    - 'spec/models/member_spec.rb'
+    - 'spec/models/project_services/chat_message/pipeline_message_spec.rb'
+    - 'spec/models/user_spec.rb'
+    - 'spec/models/wiki_page_spec.rb'
+    - 'spec/requests/api/merge_requests_spec.rb'
+    - 'spec/routing/admin_routing_spec.rb'
+    - 'spec/rubocop/cop/migration/update_large_table_spec.rb'
+    - 'spec/services/notification_service_spec.rb'
+    - 'spec/services/web_hook_service_spec.rb'
+    - 'ee/spec/models/group_spec.rb'
+    - 'ee/spec/models/user_spec.rb'
+    - 'ee/spec/requests/api/merge_request_approvals_spec.rb'
+    - 'ee/spec/services/boards/lists/update_service_spec.rb'
+    - 'ee/spec/services/geo/repository_verification_primary_service_spec.rb'
+    - 'ee/spec/workers/geo/file_download_dispatch_worker_spec.rb'

.rubocop_todo.yml

@@ -251,10 +251,6 @@ RSpec/LetBeforeExamples:
 RSpec/PredicateMatcher:
   Enabled: false
 
-# Offense count: 69
-RSpec/RepeatedExample:
-  Enabled: false
-
 # Offense count: 584
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
@@ -491,13 +487,6 @@ Style/MultilineIfModifier:
     - 'app/services/ci/process_pipeline_service.rb'
     - 'lib/api/commit_statuses.rb'
 
-# Offense count: 34
-# Cop supports --auto-correct.
-# Configuration parameters: Whitelist.
-# Whitelist: be, be_a, be_an, be_between, be_falsey, be_kind_of, be_instance_of, be_truthy, be_within, eq, eql, end_with, include, match, raise_error, respond_to, start_with
-Style/NestedParenthesizedCalls:
-  Enabled: false
-
 # Offense count: 25
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, MinBodyLength.

CHANGELOG-EE.md

 Please view this file on the master branch, on stable branches it's out of date.
 
+## 12.9.1 (2020-03-26)
+
+### Security (1 change)
+
+- Add NPM package versions SemVer validation.
+
+
 ## 12.9.0 (2020-03-22)
 
 ### Removed (1 change)

CHANGELOG.md

@@ -2,6 +2,32 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 12.9.1 (2020-03-26)
+
+### Security (16 changes)
+
+- Add permission check for pipeline status of MR.
+- Ignore empty remote_id params from Workhorse accelerated uploads.
+- External user can not create personal snippet through API.
+- Prevent malicious entry for group name.
+- Restrict mirroring changes to admins only when mirroring is disabled.
+- Reject all container registry requests from blocked users.
+- Deny localhost requests on fogbugz importer.
+- Redact notes in moved confidential issues.
+- Fix UploadRewriter Path Traversal vulnerability.
+- Block hotlinking to repository archives.
+- Restrict access to project pipeline metrics reports.
+- vulnerability_feedback records should be restricted to a dev role and above.
+- Exclude Carrierwave remote URL methods from import.
+- Update Nokogiri to fix CVE-2020-7595.
+- Prevent updating trigger by other maintainers.
+- Fix XSS vulnerability in `admin/email` "Recipient Group" dropdown.
+
+### Fixed (1 change)
+
+- Fix updating the authorized_keys file. !27798
+
+
 ## 12.9.0 (2020-03-22)
 ### Security (1 change)

GITLAB_WORKHORSE_VERSION

-8.27.0
+8.28.0

Gemfile

@@ -301,7 +301,7 @@ gem 'sentry-raven', '~> 2.9'
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '0.11.0'
+gem 'gitlab-labkit', '0.12.0'
 
 # I18n
 gem 'ruby_parser', '~> 3.8', require: false
@@ -399,7 +399,6 @@ group :test do
   gem 'fuubar', '~> 2.2.0'
   gem 'rspec-retry', '~> 0.6.1'
   gem 'rspec_profiling', '~> 0.0.5'
-  gem 'rspec-set', '~> 0.1.3'
   gem 'rspec-parameterized', require: false
 
   gem 'capybara', '~> 3.22.0'
@@ -493,3 +492,6 @@ gem 'erubi', '~> 1.9.0'
 # Monkey-patched in `config/initializers/mail_encoding_patch.rb`
 # See https://gitlab.com/gitlab-org/gitlab/issues/197386
 gem 'mail', '= 2.7.1'
+
+# File encryption
+gem 'lockbox', '~> 0.3.3'

Gemfile.lock

@@ -380,7 +380,7 @@ GEM
       rake (> 10, < 14)
       ruby-statistics (>= 2.1)
       thor (>= 0.19, < 2)
-    gitlab-labkit (0.11.0)
+    gitlab-labkit (0.12.0)
       actionpack (>= 5.0.0, < 6.1.0)
       activesupport (>= 5.0.0, < 6.1.0)
       grpc (~> 1.19)
@@ -605,6 +605,7 @@ GEM
       rb-inotify (~> 0.9, >= 0.9.7)
       ruby_dep (~> 1.2)
     locale (2.1.2)
+    lockbox (0.3.3)
     lograge (0.10.0)
       actionpack (>= 4)
       activesupport (>= 4)
@@ -652,7 +653,7 @@ GEM
     netrc (0.11.0)
     nio4r (2.5.2)
     no_proxy_fix (0.1.2)
-    nokogiri (1.10.7)
+    nokogiri (1.10.8)
       mini_portile2 (~> 2.4.0)
     nokogumbo (1.5.0)
       nokogiri
@@ -922,7 +923,6 @@ GEM
       rspec-support (~> 3.9)
     rspec-retry (0.6.1)
       rspec-core (> 3.3)
-    rspec-set (0.1.3)
     rspec-support (3.9.2)
     rspec_junit_formatter (0.4.1)
       rspec-core (>= 2, < 4, != 2.12.0)
@@ -1232,7 +1232,7 @@ DEPENDENCIES
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
   gitlab-derailed_benchmarks
-  gitlab-labkit (= 0.11.0)
+  gitlab-labkit (= 0.12.0)
   gitlab-license (~> 1.0)
   gitlab-mail_room (~> 0.0.3)
   gitlab-markup (~> 1.7.0)
@@ -1280,6 +1280,7 @@ DEPENDENCIES
   license_finder (~> 5.4)
   licensee (~> 8.9)
   liquid (~> 4.0)
+  lockbox (~> 0.3.3)
   lograge (~> 0.5)
   loofah (~> 2.2)
   lru_redux
@@ -1351,7 +1352,6 @@ DEPENDENCIES
   rspec-parameterized
   rspec-rails (~> 4.0.0.beta4)
   rspec-retry (~> 0.6.1)
-  rspec-set (~> 0.1.3)
   rspec_junit_formatter
   rspec_profiling (~> 0.0.5)
   rubocop (~> 0.74.0)

app/assets/javascripts/clusters/clusters_bundle.js

@@ -8,13 +8,20 @@ import Flash from '../flash';
 import Poll from '../lib/utils/poll';
 import initSettingsPanels from '../settings_panels';
 import eventHub from './event_hub';
-import { APPLICATION_STATUS, INGRESS, INGRESS_DOMAIN_SUFFIX, CROSSPLANE } from './constants';
+import {
+  APPLICATION_STATUS,
+  INGRESS,
+  INGRESS_DOMAIN_SUFFIX,
+  CROSSPLANE,
+  KNATIVE,
+} from './constants';
 import ClustersService from './services/clusters_service';
 import ClustersStore from './stores/clusters_store';
 import Applications from './components/applications.vue';
 import RemoveClusterConfirmation from './components/remove_cluster_confirmation.vue';
 import setupToggleButtons from '../toggle_buttons';
 import initProjectSelectDropdown from '~/project_select';
+import initServerlessSurveyBanner from '~/serverless/survey_banner';
 
 const Environments = () => import('ee_component/clusters/components/environments.vue');
 
@@ -326,6 +333,10 @@ export default class Clusters {
         this.store.state.applications[INGRESS],
       );
     }
+
+    if (this.store.state.applications[KNATIVE]?.status === APPLICATION_STATUS.INSTALLED) {
+      initServerlessSurveyBanner();
+    }
   }
 
   showToken() {

app/assets/javascripts/clusters/components/applications.vue

@@ -107,8 +107,12 @@ export default {
     isProjectCluster() {
       return this.type === CLUSTER_TYPE.PROJECT;
     },
+    managedAppsLocalTillerEnabled() {
+      return Boolean(gon.features?.managedAppsLocalTiller);
+    },
     helmInstalled() {
       return (
+        this.managedAppsLocalTillerEnabled ||
         this.applications.helm.status === APPLICATION_STATUS.INSTALLED ||
         this.applications.helm.status === APPLICATION_STATUS.UPDATED
       );
@@ -270,6 +274,7 @@ Crossplane runs inside your Kubernetes cluster and supports secure connectivity
 
     <div class="cluster-application-list prepend-top-10">
       <application-row
+        v-if="!managedAppsLocalTillerEnabled"
         id="helm"
         :logo-url="helmLogo"
         :title="applications.helm.title"

app/assets/javascripts/clusters/components/ingress_modsecurity_settings.vue

@@ -93,7 +93,10 @@ export default {
       return [UPDATING].includes(this.ingress.status);
     },
     saveButtonDisabled() {
-      return [UNINSTALLING, UPDATING, INSTALLING].includes(this.ingress.status);
+      return (
+        [UNINSTALLING, UPDATING, INSTALLING].includes(this.ingress.status) ||
+        this.ingress.updateAvailable
+      );
     },
     saveButtonLabel() {
       return this.saving ? __('Saving') : __('Save changes');
@@ -105,13 +108,14 @@ export default {
      *     neither getting installed nor updated.
      */
     showButtons() {
-      return (
-        this.saving || (this.hasValueChanged && [INSTALLED, UPDATED].includes(this.ingress.status))
-      );
+      return this.saving || this.valuesChangedByUser;
     },
     modSecurityModeName() {
       return this.modes[this.ingress.modsecurity_mode].name;
     },
+    valuesChangedByUser() {
+      return this.hasValueChanged && [INSTALLED, UPDATED].includes(this.ingress.status);
+    },
   },
   methods: {
     updateApplication() {

app/assets/javascripts/clusters/stores/clusters_store.js

@@ -59,6 +59,7 @@ export default class ClusterStore {
           isEditingModSecurityEnabled: false,
           isEditingModSecurityMode: false,
           updateFailed: false,
+          updateAvailable: false,
         },
         cert_manager: {
           ...applicationInitialState,
@@ -213,6 +214,7 @@ export default class ClusterStore {
       if (appId === INGRESS) {
         this.state.applications.ingress.externalIp = serverAppEntry.external_ip;
         this.state.applications.ingress.externalHostname = serverAppEntry.external_hostname;
+        this.state.applications.ingress.updateAvailable = updateAvailable;
         if (!this.state.applications.ingress.isEditingModSecurityEnabled) {
           this.state.applications.ingress.modsecurity_enabled = serverAppEntry.modsecurity_enabled;
         }

app/assets/javascripts/environments/components/confirm_rollback_modal.vue

@@ -3,7 +3,7 @@
  * Render modal to confirm rollback/redeploy.
  */
 
-import _ from 'underscore';
+import { escape as esc } from 'lodash';
 import { GlModal } from '@gitlab/ui';
 import { s__, sprintf } from '~/locale';
 
@@ -30,7 +30,7 @@ export default {
         : s__('Environments|Rollback environment %{name}?');
 
       return sprintf(title, {
-        name: _.escape(this.environment.name),
+        name: esc(this.environment.name),
       });
     },
 
@@ -50,10 +50,10 @@ export default {
     },
 
     modalText() {
-      const linkStart = `<a class="commit-sha mr-0" href="${_.escape(this.commitUrl)}">`;
-      const commitId = _.escape(this.commitShortSha);
+      const linkStart = `<a class="commit-sha mr-0" href="${esc(this.commitUrl)}">`;
+      const commitId = esc(this.commitShortSha);
       const linkEnd = '</a>';
-      const name = _.escape(this.name);
+      const name = esc(this.name);
       const body = this.environment.isLastDeployment
         ? s__(
             'Environments|This action will relaunch the job for commit %{linkStart}%{commitId}%{linkEnd}, putting the environment in a previous version. Are you sure you want to continue?',

app/assets/javascripts/environments/components/environment_item.vue

 <script>
 /* eslint-disable @gitlab/vue-require-i18n-strings */
-import _ from 'underscore';
+import { isEmpty } from 'lodash';
 import { GlTooltipDirective } from '@gitlab/ui';
 import { __, sprintf } from '~/locale';
 import { convertObjectPropsToCamelCase } from '~/lib/utils/common_utils';
@@ -79,7 +79,7 @@ export default {
      * @returns {Boolean}
      */
     hasLastDeploymentKey() {
-      if (this.model && this.model.last_deployment && !_.isEmpty(this.model.last_deployment)) {
+      if (this.model && this.model.last_deployment && !isEmpty(this.model.last_deployment)) {
         return true;
       }
       return false;
@@ -390,8 +390,8 @@ export default {
     deploymentHasUser() {
       return (
         this.model &&
-        !_.isEmpty(this.model.last_deployment) &&
-        !_.isEmpty(this.model.last_deployment.user)
+        !isEmpty(this.model.last_deployment) &&
+        !isEmpty(this.model.last_deployment.user)
       );
     },
 
@@ -404,8 +404,8 @@ export default {
     deploymentUser() {
       if (
         this.model &&
-        !_.isEmpty(this.model.last_deployment) &&
-        !_.isEmpty(this.model.last_deployment.user)
+        !isEmpty(this.model.last_deployment) &&
+        !isEmpty(this.model.last_deployment.user)
       ) {
         return this.model.last_deployment.user;
       }
@@ -431,8 +431,8 @@ export default {
     shouldRenderBuildName() {
       return (
         !this.isFolder &&
-        !_.isEmpty(this.model.last_deployment) &&
-        !_.isEmpty(this.model.last_deployment.deployable)
+        !isEmpty(this.model.last_deployment) &&
+        !isEmpty(this.model.last_deployment.deployable)
       );
     },
 
@@ -473,7 +473,7 @@ export default {
     shouldRenderDeploymentID() {
       return (
         !this.isFolder &&
-        !_.isEmpty(this.model.last_deployment) &&
+        !isEmpty(this.model.last_deployment) &&
         this.model.last_deployment.iid !== undefined
       );
     },

app/assets/javascripts/environments/components/environments_table.vue

@@ -3,7 +3,7 @@
  * Render environments table.
  */
 import { GlLoadingIcon } from '@gitlab/ui';
-import _ from 'underscore';
+import { flow, reverse, sortBy } from 'lodash/fp';
 import environmentTableMixin from 'ee_else_ce/environments/mixins/environments_table_mixin';
 import { s__ } from '~/locale';
 import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
@@ -102,13 +102,13 @@ export default {
        * 4. Reverse (last deployment descending, name ascending),
        * 5. Put folders first.
        */
-      return _.chain(environments)
-        .sortBy(env => (env.isFolder ? env.folderName : env.name))
-        .reverse()
-        .sortBy(env => (env.last_deployment ? env.last_deployment.created_at : '0000'))
-        .reverse()
-        .sortBy(env => (env.isFolder ? -1 : 1))
-        .value();
+      return flow(
+        sortBy(env => (env.isFolder ? env.folderName : env.name)),
+        reverse,
+        sortBy(env => (env.last_deployment ? env.last_deployment.created_at : '0000')),
+        reverse,
+        sortBy(env => (env.isFolder ? -1 : 1)),
+      )(environments);
     },
   },
 };

app/assets/javascripts/environments/mixins/environments_mixin.js

 /**
  * Common code between environmets app and folder view
  */
-import _ from 'underscore';
+import { isEqual, isFunction, omitBy } from 'lodash';
 import Visibility from 'visibilityjs';
 import EnvironmentsStore from 'ee_else_ce/environments/stores/environments_store';
 import Poll from '../../lib/utils/poll';
@@ -54,7 +54,7 @@ export default {
       const response = this.filterNilValues(resp.config.params);
       const request = this.filterNilValues(this.requestData);
 
-      if (_.isEqual(response, request)) {
+      if (isEqual(response, request)) {
         this.store.storeAvailableCount(resp.data.available_count);
         this.store.storeStoppedCount(resp.data.stopped_count);
         this.store.storeEnvironments(resp.data.environments);
@@ -64,7 +64,7 @@ export default {
     },
 
     filterNilValues(obj) {
-      return _.omit(obj, value => _.isUndefined(value) || _.isNull(value));
+      return omitBy(obj, value => value === undefined || value === null);
     },
 
     /**
@@ -109,7 +109,7 @@ export default {
           .then(() => this.fetchEnvironments())
           .catch(err => {
             this.isLoading = false;
-            Flash(_.isFunction(errorMessage) ? errorMessage(err.response.data) : errorMessage);
+            Flash(isFunction(errorMessage) ? errorMessage(err.response.data) : errorMessage);
           });
       }
     },