Skip to content

Rate limit the integration testing endpoint

Summary

Similar to the rate limit we introduced for webhook testing in #223681 (closed) / https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/826, we should do the same for the Test settings button on integration forms.

Currently only the general rate limit for authenticated web requests applies.

Improvements

Add a rate limit around the Projects::ServicesController#test action at https://gitlab.com/gitlab-org/gitlab/blob/1f9cea0234129104ab502e8a2d1b75b73601eb27/app/controllers/projects/services_controller.rb#L62.

Maybe we can use the same threshold/interval as for the webhook testing at https://gitlab.com/gitlab-org/gitlab/blob/1f9cea0234129104ab502e8a2d1b75b73601eb27/lib/gitlab/application_rate_limiter.rb#L26.

The test action is currently only available at the project level, so we don't need to worry about the admin and group controllers (see https://gitlab.com/gitlab-org/gitlab/blob/1f9cea0234129104ab502e8a2d1b75b73601eb27/app/controllers/concerns/integrations/actions.rb#L40).

Edited by Markus Koller