Direct asset URL for releases is returning 404 Not Found
Summary
Found while testing !37557 (merged).
When you create a release with external assets link (for example https://gitlab.com/api/v4/projects/11775053/releases/assets-links-1), direct_asset_url
returned is the following:
$ curl https://gitlab.com/api/v4/projects/11775053/releases/assets-links-1 | jq | grep direct_asset_url
"direct_asset_url": "https://gitlab.com/krasio/public-test-yard/-/releases/assets-links-1/binaries/1",
When you try to access this URL it returns 404 Found
instead of redirecting to the external URL.
The reason is that we generate this URL using format like /releases/:tag/:filepath
, while the route defined for asset links downloads is /releases/:tag/downloads/*filepath
:
- https://gitlab.com/gitlab-org/gitlab/-/blob/9cda1414a433c841980d2aa8625c89fd15c9fef6/lib/api/entities/releases/link.rb#L20
- https://gitlab.com/gitlab-org/gitlab/-/blob/9cda1414a433c841980d2aa8625c89fd15c9fef6/config/routes/project.rb#L196
Even if you manually change the URL from /releases/assets-links-1/binaries/1
to /releases/assets-links-1/downloads/binaries/1
it's still not working. The reason is that because the way the route is defined ('downloads/*filepath'
) the leading slash is not included in params[:filepath]
but in the controller we do release.links.find_by_filepath!(sanitized_filepath)
so it fails to find the link.
Steps to reproduce
- Create a release that has an external asset link (using the API)
- Try to access the external asset
Example Project
https://gitlab.com/krasio/public-test-yard/-/releases
What is the current bug behavior?
The direct asset URL returns 404 Not Found
What is the expected correct behavior?
The direct asset URL should redirect to the external asset, see https://gitlab.com/gitlab-org/gitlab/-/blob/9cda1414a433c841980d2aa8625c89fd15c9fef6/spec/controllers/projects/releases_controller_spec.rb#L212-250 (btw this spec is passing because it is controller spec and is bypassing the routing, so the filepath
is provided as expected).
Possible fixes
- We can update the way we generate
direct_assets_url
to match the route - We can update the route to match the currently generated
direct_assets_url
IN either case we'll have to add the missing leading slash before we try to find the link from the database. I could not find a way how to define the route in away so that it doesn't remove the leading slash from the param.