Skip to content

Wrap Elasticsearch results as blob

Mark Chao requested to merge 36439-redact-2 into master

What does this MR do?

Change SearchService to return FoundBlob as search result, which can be checked by our policy class.

Details

Currently, for blob searches, the raw Elasticsearch::Model::Response::Result is returned by SearchService. This is then wrapped as FoundBlob during view rendering (inside haml file).

However our policy check is located within SearchService, prior to view rendering. Therefore policy check is not enforced on blobs.

This MR wraps the search results as FoundBlob and FoundWikiPage (new class) inside Service, so they can be policy checked.

The view layer is freed from the burden of wrapping the results, and code no longer in use are removed.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by 🤖 GitLab Bot 🤖

Merge request reports