Skip to content

Move ref validation to services

What does this MR do and why?

Relate issue: https://gitlab.com/gitlab-org/gitlab/-/issues/435357

Move ref validation to services

Due to existing data causing breaking changes to the system, this MR moves the ref format validations for pipeline_schedules to the Create and Update services, as a first step toward patching a security flaw.

We will be using an existing feature flag for this feature.

The next step will be to properly introduce Ref validations which is being planned here.

How to set up and validate locally

Common steps

  • Enable feature flag enforce_full_refs_for_pipeline_schedules
  • Create a new project or select an existing one
  • On the left panel navigate to Code -> Branches
  • Create a new protected branch

Case 1 Ref is not ambiguous and can be inferred

  • on the left panel go to Builds -> Pipeline Schedules
  • Create a new schedule, you will see that the ref is by has a default value, don't change it, just populate the required fields and click create
  • The schedule should have been created successfully, even though a short ref was passed
  • Check the newly created schedule's Target column on the schedules list, there should be the branch symbol, this means that the ref was expanded

Case 2: Ambiguous ref

  • On the left panel, navigate to Code -> Tags
  • Create a new tag with the same name as the branch you created (select any base branch you want)
  • On the left panel, navigate to Settings -> Repository -> Default Branches and make the new branch the default one
  • Finally, on the left panel go to Builds -> Pipeline Schedules
  • Create a new schedule, you will see that the ref is by has a default value, don't change it, just populate the required fields and click create
  • An ambiguous ref error should have been triggered

Note: Both cases should have the same behaviour when updating a schedule

Edited by Lee Tickett

Merge request reports