Skip to content

Fix PrometheusService validation for non-manual configurations

What does this MR do?

There is a bug in the PrometheusService validations, where the if: :manual_configuration? condition is being ignored.

This is due to the following (from https://api.rubyonrails.org/?q=with_options):

NOTE: Each nesting level will merge inherited defaults in addition to their own.

class Post < ActiveRecord::Base
  with_options if: :persisted?, length: { minimum: 50 } do
    validates :content, if: -> { content.present? }
  end
end

The code is equivalent to:

validates :content, length: { minimum: 50 }, if: -> { content.present? }

Hence the inherited default for if key is ignored.

This means that the validation as there were, were being executed as:

validates :api_url, public_url: true, presence: true, unless: proc { |object| object.allow_local_api_url? }, if: :manual_configuration?
validates :api_url, url: true, presence: true, if: proc { |object| object.allow_local_api_url? }

Notice that the second case above loses it's if: :manual_configuration? condition.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Closes #213036 (closed)

Edited by Sean Arnold

Merge request reports