Skip to content

Do not expand TRIGGER_PAYLOAD variable

What does this MR do and why?

This MR prevents TRIGGER_PAYLOAD var to be expanded.

Why?

It is not documented and not expected that TRIGGER_PAYLOAD would be expanded. Few examples of requests:
curl -X POST -H "Content-Type: application/json" -d '{"key1":"$MYVAR"}' https://gitlab/api/v4/projects/1/ref/master/trigger/pipeline?token=glptt-XXXXX
This request will result in following TRIGGER_PAYLOAD content:
{"key1":"","id":"123","ref":"master","variables":{}}
Furthermore it is security risk, as in case MYVAR=mypass is defined in project it will leak, as TRIGGER_PAYLOAD would be:
{"key1":"mypass","id":"123","ref":"master","variables":{}}
This request -d '{"key1":"text text text ${ text"}' will end up with following content:
{"key1":"text text text } so it breaks json and can't be parsed at all.

One of the most popular way of using trigger token is to trigger pipeline using another gitlab project's webhook Issue 31197, e.g. project A MR event triggers pipeline on project B. In case of MR description contains ${ it breaks json schema. Or even worse leaks project's B CI/CD variables.

Edited by Vytautas Bertašius

Merge request reports