Implement checking ref when rendering CI Config blob page
What does this MR do and why?
When rendering a CI config blob page, there is a CI Lint result section. This section calls the CI Lint service and renders the result. This happens for all ref types; branch, tag, sha. And this causes a vulnerability. We fixed this vulnerability before but it requires a slow Git operation.
In this MR, we are eliminating this Git operation by sending the
verify_project_sha parameter to the Ci::Lint service. We can safely
send this parameter now because we render this CI Lint section only
when the page is rendered via a branch or a tag ref.
Related to #473102 (closed)
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
| Before | After | Diff |
|---|---|---|
![]() |
![]() |
No change |
![]() |
![]() |
The validation message is gone |
Edited by Furkan Ayhan


