Skip to content

Resolve "Project name to path conversion in API mangles dots"

What does this MR do?

Previously, when creating a new project using the REST API, only specifying the name

curl -X "POST" "http://ee.gitlab.test:5100/api/v4/projects?name=morx.fleem7" \
     -H 'PRIVATE-TOKEN: something'

we would set the path == to the parameterization of the name -- morrx-fleem7. However . is allowed in the project path, as can be see in the UI

Now, we see if the name matches the format of a valid path, Gitlab::PathRegex.project_path_format_regex, then allow it, otherwise use parameterize to ensure a valid path.

This maintains the API v4 behavior of creating a valid path automatically from the name. Once we push to API v5, we should consider removing this to be consistent with how the other params are validated, bubbling up the error.

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #18292 (closed)

Edited by Brett Walker

Merge request reports