Ruby nil bug on project creation with different namespace ids

Hello,

I stumbled upon this by accident using curl to create a new project in a group namespace. Basically changing the namespace id results in the Ruby nil error in one namespace that is not mine, and a different error in another namespace that is not mine:

curl -s -w "\n%{http_code}" -X POST "https://gitlab.com/api/v4/projects" -H "PRIVATE-TOKEN: <VALID-TOKEN-REDACTED>" -H "Content-Type: application/json" --data "{\"name\": \"test-repo\", \"visibility\": \"private\", \"namespace_id\": "<MY-NAMESPACE-ID>"}"
{<long success response>}
201
curl -s -w "\n%{http_code}" -X POST "https://gitlab.com/api/v4/projects" -H "PRIVATE-TOKEN: <VALID-TOKEN-REDACTED>" -H "Content-Type: application/json" --data "{\"name\": \"test-repo\", \"visibility\": \"private\", \"namespace_id\": "<OTHER-NAMESPACE-ID>"}"

{"message":{"base":["undefined method `organization_id' for nil:NilClass"]}}
400%
curl -s -w "\n%{http_code}" -X POST "https://gitlab.com/api/v4/projects" -H "PRIVATE-TOKEN: <VALID-TOKEN-REDACTED>" -H "Content-Type: application/json" --data "{\"name\": \"test-repo\", \"visibility\": \"private\", \"namespace_id\": "<OTHER-NAMESPACE-ID-2>"}"

{"message":{"namespace":["is not valid"]}}
400%

I would expect the response message to not leak information about which namespace ids are active or not - presumably? Perhaps this is not actually an issue as I haven't done too much digging.

Edited by 🤖 GitLab Bot 🤖