500 Internal Server Error Updating Group with Malformed Description

Summary

500 Internal Server Error editing group with malformed description. Any malformed field (expect boolean fields) will cause the same error.

Example

echo -e '{"lfs_enabled":"true","request_access_enabled":"false","name":"70328800b01940b78ffcf462a6f4b9594","path":"local","visibility":"internal","description":"st\xdaring"}' | curl -v -X 'PUT'  -H "Content-Type: application/json" -H 'PRIVATE-TOKEN: [FILTERED]' 'http://127.0.0.1/api/v4/groups/4' -d @-

Example Project

The bug is reproducible on "gitlab.com" and on our local deployment with source code installation of enterprise edition (13-0-stable branch).

What is the current bug behavior?

HTTP Response: "500 Internal Server Error."

What is the expected correct behavior?

HTTP Response: "400 Bad Request: {"error":"description parameter is invalid"}"

Relevant logs and/or screenshots

==> /home/git/gitlab/log/production.log <==                                                                                   
Started PUT "/api/v4/groups/4" for 127.0.0.1 at 2020-08-07 12:51:53 +0000                                                            
                                                                                                                                 
==> /home/git/gitlab/log/exceptions_json.log <==                                                                                 
{"severity":"ERROR","time":"2020-08-07T12:51:53.241Z","correlation_id":"dFs89NhUr55","tags.correlation_id":"dFs89NhUr55","tags.locale":"en","user.id":1,"user.email":"admin@example.com","user.username":"root","extra.server":{"os":{"name":"
Linux","version":"#31~18.04.1-Ubuntu SMP Mon Jun 22 15:24:52 UTC 2020","build":"5.3.0-1029-gcp","kernel_version":"Linux gitlab-bugreports-test-instance 5.3.0-1029-gcp #31~18.04.1-Ubuntu SMP Mon Jun 22 15:24:52 UTC 2020 x86_64 x86_64 x86_6
4 GNU/Linux"},"runtime":{"name":"ruby","version":"ruby 2.6.6p146 (2020-03-31 revision 67876) [x86_64-linux]"}},"extra.lfs_enabled":"true","extra.request_access_enabled":"false","extra.name":"70328800b01940b78ffcf462a6f4b9594","extra.path"
:"dscds","extra.visibility":"internal","extra.description":"[FILTERED]","exception.class":"ArgumentError","exception.message":"invalid byte sequence in UTF-8","exception.backtrace":["lib/banzai/filter/front_matter_filter.rb:9:in `sub'","l
ib/banzai/filter/front_matter_filter.rb:9:in `call'","lib/banzai/pipeline/base_pipeline.rb:23:in `block (2 levels) in singleton class'","lib/banzai/renderer.rb:128:in `render_result'","lib/banzai/renderer.rb:164:in `block in cacheless_ren
der'","lib/gitlab/metrics.rb:71:in `measure'","lib/banzai/renderer.rb:163:in `cacheless_render'","lib/banzai/renderer.rb:52:in `cacheless_render_field'","app/models/concerns/cache_markdown_field.rb:49:in `rendered_field_content'","app/mod
els/concerns/cache_markdown_field.rb:58:in `block in refresh_markdown_cache'","app/models/concerns/cache_markdown_field.rb:55:in `map'","app/models/concerns/cache_markdown_field.rb:55:in `refresh_markdown_cache'","app/services/groups/upda
te_service.rb:25:in `execute'","lib/api/groups.rb:60:in `update_group'","lib/api/groups.rb:173:in `block (2 levels) in \u003cclass:Groups\u003e'"]}                       
                                                                                                                                                                           
==> /home/git/gitlab/log/production.log <==                                                                                                                 
                                                                                                                                                                
ArgumentError (invalid byte sequence in UTF-8):                                                                                                             
  /home/git/gitlab/lib/banzai/filter/front_matter_filter.rb:9:in `sub'                                                                                 
  /home/git/gitlab/lib/banzai/filter/front_matter_filter.rb:9:in `call'                                                                                          
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline/filter.rb:129:in `call'                                               
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:134:in `block in perform_filter'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:172:in `instrument'                                  
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:133:in `perform_filter' 
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:119:in `block (2 levels) in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:118:in `each'    
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:118:in `inject'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:118:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:172:in `instrument'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:116:in `call'                              
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/html-pipeline-2.12.2/lib/html/pipeline.rb:148:in `to_html'                 
  /home/git/gitlab/lib/banzai/pipeline/base_pipeline.rb:23:in `block (2 levels) in singleton class'                    
  /home/git/gitlab/lib/banzai/renderer.rb:128:in `render_result'                                                      
  /home/git/gitlab/lib/banzai/renderer.rb:164:in `block in cacheless_render'                                                
  /home/git/gitlab/lib/gitlab/metrics.rb:71:in `measure'                                                                          
  /home/git/gitlab/lib/banzai/renderer.rb:163:in `cacheless_render'                                             
  /home/git/gitlab/lib/banzai/renderer.rb:52:in `cacheless_render_field'                               
  /home/git/gitlab/app/models/concerns/cache_markdown_field.rb:49:in `rendered_field_content'                                                                                                                                                   /home/git/gitlab/app/models/concerns/cache_markdown_field.rb:58:in `block in refresh_markdown_cache'                                                                                                                                          /home/git/gitlab/app/models/concerns/cache_markdown_field.rb:55:in `map'                                                                                                                                                                      /home/git/gitlab/app/models/concerns/cache_markdown_field.rb:55:in `refresh_markdown_cache'                                                                                                                                                   /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:428:in `block in make_lambda'                                                                                                              /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:181:in `block (2 levels) in halting_and_conditional'                                                                                       /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:605:in `block (2 levels) in default_terminator'                                                                                            /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:604:in `catch'       
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:604:in `block in default_terminator'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:182:in `block in halting_and_conditional'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:513:in `block in invoke_before'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:513:in `each'         
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:513:in `invoke_before'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:134:in `run_callbacks'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:825:in `_run_update_callbacks'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/callbacks.rb:335:in `_update_record'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/timestamp.rb:123:in `_update_record'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/persistence.rb:905:in `create_or_update'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/callbacks.rb:327:in `block in create_or_update'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:135:in `run_callbacks'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:825:in `_run_save_callbacks'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/callbacks.rb:327:in `create_or_update'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/timestamp.rb:128:in `create_or_update'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/persistence.rb:470:in `save'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/validations.rb:47:in `save'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/transactions.rb:314:in `block in save'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/transactions.rb:375:in `block in with_transaction_returning_status'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/connection_adapters/abstract/database_statements.rb:280:in `block in transaction'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/connection_adapters/abstract/transaction.rb:280:in `block in within_new_transaction'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/concurrency/load_interlock_aware_monitor.rb:26:in `block (2 levels) in synchronize'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/concurrency/load_interlock_aware_monitor.rb:25:in `handle_interrupt'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/concurrency/load_interlock_aware_monitor.rb:25:in `block in synchronize'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/concurrency/load_interlock_aware_monitor.rb:21:in `handle_interrupt'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/concurrency/load_interlock_aware_monitor.rb:21:in `synchronize'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/connection_adapters/abstract/transaction.rb:278:in `within_new_transaction'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/connection_adapters/abstract/database_statements.rb:280:in `transaction'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/transactions.rb:212:in `transaction'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/transactions.rb:366:in `with_transaction_returning_status'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/transactions.rb:314:in `save'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activerecord-6.0.3/lib/active_record/suppressor.rb:44:in `save'
  /home/git/gitlab/app/services/groups/update_service.rb:25:in `execute'
  /home/git/gitlab/lib/api/groups.rb:60:in `update_group'
  /home/git/gitlab/lib/api/groups.rb:173:in `block (2 levels) in <class:Groups>'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:57:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:57:in `block (2 levels) in generate_api_method'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/notifications.rb:182:in `instrument'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:56:in `block in generate_api_method'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:262:in `block in run'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/notifications.rb:182:in `instrument'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:243:in `run'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:313:in `block in build_stack'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:31:in `call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:24:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:31:in `call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:24:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:31:in `call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:24:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-oauth2-1.9.3/lib/rack/oauth2/server/resource.rb:20:in `_call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-oauth2-1.9.3/lib/rack/oauth2/server/resource/bearer.rb:8:in `_call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-oauth2-1.9.3/lib/rack/oauth2/server/abstract/handler.rb:17:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/error.rb:38:in `block in call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/error.rb:37:in `catch'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/error.rb:37:in `call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:24:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape_logging-1.8.3/lib/grape_logging/middleware/request_logger.rb:60:in `block in call!'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape_logging-1.8.3/lib/grape_logging/middleware/request_logger.rb:58:in `catch'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape_logging-1.8.3/lib/grape_logging/middleware/request_logger.rb:58:in `call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/middleware/base.rb:24:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/head.rb:12:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:227:in `call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/endpoint.rb:221:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router/route.rb:72:in `exec'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router.rb:121:in `process_route'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router.rb:74:in `block in identity'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router.rb:93:in `transaction'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router.rb:72:in `identity'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router.rb:57:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router.rb:137:in `with_optimization'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/router.rb:56:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/api.rb:119:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/api.rb:45:in `call!'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/grape-1.1.0/lib/grape/api.rb:40:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/routing/mapper.rb:19:in `block in <class:Constraints>'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/routing/mapper.rb:48:in `serve'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/journey/router.rb:49:in `block in serve'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/journey/router.rb:32:in `each'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/journey/router.rb:32:in `serve'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/routing/route_set.rb:834:in `call'
  /home/git/gitlab/lib/gitlab/request_profiler/middleware.rb:17:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-labkit-0.12.0/lib/labkit/middleware/rack.rb:19:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-labkit-0.12.0/lib/labkit/context.rb:32:in `with_context'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-labkit-0.12.0/lib/labkit/middleware/rack.rb:18:in `call'
  /home/git/gitlab/lib/gitlab/middleware/go.rb:20:in `call'
  /home/git/gitlab/lib/gitlab/etag_caching/middleware.rb:13:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/batch-loader-1.4.0/lib/batch_loader/middleware.rb:11:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-attack-6.3.0/lib/rack/attack.rb:97:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/apollo_upload_server-2.0.0.beta.3/lib/apollo_upload_server/middleware.rb:20:in `call'
  /home/git/gitlab/lib/gitlab/middleware/multipart.rb:125:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-attack-6.3.0/lib/rack/attack.rb:111:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/warden-1.2.8/lib/warden/manager.rb:36:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/warden-1.2.8/lib/warden/manager.rb:34:in `catch'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/warden-1.2.8/lib/warden/manager.rb:34:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-cors-1.0.6/lib/rack/cors.rb:98:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/tempfile_reaper.rb:15:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/etag.rb:25:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/conditional_get.rb:38:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/head.rb:12:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/http/content_security_policy.rb:18:in `call'
  /home/git/gitlab/lib/gitlab/middleware/read_only/controller.rb:51:in `call'
  /home/git/gitlab/lib/gitlab/middleware/read_only.rb:18:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/session/abstract/id.rb:259:in `context'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/session/abstract/id.rb:253:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/cookies.rb:648:in `call'
  /home/git/gitlab/lib/gitlab/middleware/same_site_cookies.rb:27:in `call'
 /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/session/abstract/id.rb:259:in `context'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/session/abstract/id.rb:253:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/cookies.rb:648:in `call'
  /home/git/gitlab/lib/gitlab/middleware/same_site_cookies.rb:27:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/callbacks.rb:101:in `run_callbacks'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/callbacks.rb:26:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/actionable_exceptions.rb:17:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/debug_exceptions.rb:32:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/show_exceptions.rb:33:in `call'
  /home/git/gitlab/lib/gitlab/middleware/basic_health_check.rb:25:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3/lib/rails/rack/logger.rb:37:in `call_app'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3/lib/rails/rack/logger.rb:26:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/tagged_logging.rb:80:in `block in tagged'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/tagged_logging.rb:28:in `tagged'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3/lib/active_support/tagged_logging.rb:80:in `tagged'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3/lib/rails/rack/logger.rb:26:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/remote_ip.rb:81:in `call'
  /home/git/gitlab/lib/gitlab/middleware/request_context.rb:23:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/request_store-1.5.0/lib/request_store/middleware.rb:19:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/request_id.rb:27:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/method_override.rb:22:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/runtime.rb:22:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-timeout-0.5.1/lib/rack/timeout/core.rb:123:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-timeout-0.5.1/lib/rack/timeout/support/timeout.rb:19:in `timeout'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-timeout-0.5.1/lib/rack/timeout/core.rb:122:in `call'
  /home/git/gitlab/config/initializers/fix_local_cache_middleware.rb:9:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/executor.rb:14:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/sendfile.rb:111:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3/lib/action_dispatch/middleware/host_authorization.rb:76:in `call'
  /home/git/gitlab/lib/gitlab/metrics/requests_rack_middleware.rb:60:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/sentry-raven-2.9.0/lib/raven/integrations/rack.rb:51:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3/lib/rails/engine.rb:527:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3/lib/rails/railtie.rb:190:in `public_send'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3/lib/rails/railtie.rb:190:in `method_missing'
  /home/git/gitlab/lib/gitlab/middleware/release_env.rb:12:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/urlmap.rb:68:in `block in call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/urlmap.rb:53:in `each'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rack-2.0.9/lib/rack/urlmap.rb:53:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-puma-4.3.3.gitlab.2/lib/puma/configuration.rb:228:in `call'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-puma-4.3.3.gitlab.2/lib/puma/server.rb:691:in `handle_request'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-puma-4.3.3.gitlab.2/lib/puma/server.rb:481:in `process_client'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-puma-4.3.3.gitlab.2/lib/puma/server.rb:335:in `block in run'
  /home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/gitlab-puma-4.3.3.gitlab.2/lib/puma/thread_pool.rb:138:in `block in spawn_thread'


==> /home/git/gitlab/log/api_json.log <==
{"time":"2020-08-07T12:51:53.245Z","severity":"INFO","duration_s":0.02357,"db_duration_s":0.00462,"view_duration_s":0.01895,"status":500,"method":"PUT","path":"/api/v4/groups/4","params":[{"key":"lfs_enabled","value":"true"},{"key":"reque
st_access_enabled","value":"false"},{"key":"name","value":"70328800b01940b78ffcf462a6f4b9594"},{"key":"path","value":"dscds"},{"key":"visibility","value":"internal"},{"key":"description","value":"[FILTERED]"}],"host":"127.0.0.1","remote_i
p":"127.0.0.1, 127.0.0.1","ua":"curl/7.58.0","route":"/api/:version/groups/:id","user_id":1,"username":"root","exception.class":"ArgumentError","exception.message":"invalid byte sequence in UTF-8","exception.backtrace":["lib/banzai/filter
/front_matter_filter.rb:9:in `sub'","lib/banzai/filter/front_matter_filter.rb:9:in `call'","lib/banzai/pipeline/base_pipeline.rb:23:in `block (2 levels) in singleton class'","lib/banzai/renderer.rb:128:in `render_result'","lib/banzai/rend
erer.rb:164:in `block in cacheless_render'","lib/gitlab/metrics.rb:71:in `measure'","lib/banzai/renderer.rb:163:in `cacheless_render'","lib/banzai/renderer.rb:52:in `cacheless_render_field'","app/models/concerns/cache_markdown_field.rb:49
:in `rendered_field_content'","app/models/concerns/cache_markdown_field.rb:58:in `block in refresh_markdown_cache'","app/models/concerns/cache_markdown_field.rb:55:in `map'","app/models/concerns/cache_markdown_field.rb:55:in `refresh_mark
down_cache'","app/services/groups/update_service.rb:25:in `execute'","lib/api/groups.rb:60:in `update_group'","lib/api/groups.rb:173:in `block (2 levels) in <class:Groups>'"],"queue_duration_s":0.011336,"redis_calls":1,"redis_duration_s":
0.000214,"correlation_id":"dFs89NhUr55","meta.user":"root","meta.caller_id":"/api/:version/groups/:id"}

==> /home/git/gitlab/log/gitlab-workhorse.log <==
127.0.0.1 127.0.0.1 - - [2020/08/07:12:51:53 +0000] "PUT /api/v4/groups/4 HTTP/1.1" 500 39 "" "curl/7.58.0" 37


Results of GitLab application Check

Checking GitLab subtasks ...       
                
Checking GitLab Shell ...                           
                                                  
GitLab Shell: ... GitLab Shell version >= 13.2.0 ? ... OK (13.2.0)
Running /home/git/gitlab-shell/bin/check
Internal API available: OK                
Redis available via internal API: OK         
gitlab-shell self-check successful                                
                                           
Checking GitLab Shell ... Finished
                                
Checking Gitaly ...

Gitaly: ... default ... OK           

Checking Gitaly ... Finished                                                                                                                                                                                                                 

Checking Sidekiq ...

Sidekiq: ... Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished
Checking GitLab App ...

Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet)
Init script exists? ... yes
Init script up-to-date? ... yes
Projects have namespace: ... can't check, you have no projects
Redis version >= 4.0.0? ... yes
Ruby version >= 2.5.3 ? ... yes (2.6.6)
Git version >= 2.22.0 ? ... yes (2.27.0)
Git user has default SSH configuration? ... yes
Active users: ... 1
Is authorized keys file accessible? ... yes
GitLab configured to store new projects in hashed storage? ... yes
All projects are in hashed storage? ... yes

Checking GitLab App ... Finished

Checking GitLab subtasks ... Finished

Comments

This bug was found using REST API fuzzing.