Skip to content

Reject invalid repository archive request formats

Joe Woodward requested to merge fix/407534-archive-requests-trigger-500 into master

What does this MR do and why?

Reject invalid repository archive request formats

Fixes #407534 (closed)

Archive requests with invalid formats throw 500 errors. Our archive endpoint uses a format constraint, however, we do not ensure that all requests passed a valid format.

This change ensures a valid format is passed to the route. Any invalid formats will result in a 404 response.

https://guides.rubyonrails.org/routing.html#:~:text=If%20you%20want%20to%20make%20the%20format%20segment%20mandatory%2C%20so%20it%20cannot%20be%20omitted%2C%20you%20can%20supply%20format%3A%20true%20like%20this%3A

Changelog: fixed

How to set up and validate locally

Should download successfully

Gitlab uses metadata in links that prevent these from working when clicked. You need to new tab/window and paste the link for the file to actually download.

  1. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.zip
  2. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.tar
  3. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.tar.gz
  4. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.tgz
  5. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.gz
  6. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.tar.bz2
  7. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.tbz
  8. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.tbz2
  9. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.tb2
  10. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.bz2

Should render 404

  1. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.yml
  2. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.yaml
  3. http://gdk.test:3000/gitlab-org/cli/-/archive/main/foo.text

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Joe Woodward

Merge request reports