Ensure even select values in UNION query [RUN AS-IF-FOSS]

What does this MR do?

This MR adds an extra check to the Gitlab::SQL::Union class to verify the number of select values of the passed in relations. If uneven number of columns are detected, an error will be raised. This only happens in test environment.

The MR also adds documentation explaining and fixing the problem.

• I have added/updated tests following the Testing Guide, or it's not needed. (Consider all test levels. See the Test Planning Process.)
• I have tested this MR in all supported browsers, or it's not needed.
• I have informed the Infrastructure department of a default or new setting change per definition of done, or it's not needed.

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

• Label as security and @ mention @gitlab-com/gl-security/appsec
• The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• Security reports checked/validated by a reviewer from the AppSec team

changed milestone to %14.2

added database label

assigned to @ahegyi

added databasereview pending label

added backend documentation labels

	3 Messages
	CHANGELOG missing: If you want to create a changelog entry for GitLab FOSS, add the Changelog trailer to the commit message you want to add to the changelog. If you want to create a changelog entry for GitLab EE, also add the EE: true trailer to your commit message. If this merge request doesn't need a CHANGELOG entry, feel free to ignore this message.
	This merge request adds or changes files that require a review from the Database team.
	This merge request adds or changes documentation files. A review from the Technical Writing team before you merge is recommended. Reviews can happen after you merge.

This merge request requires a database review. To make sure these changes are reviewed, take the following steps:

1. Ensure the merge request has database and databasereview pending labels. If the merge request modifies database files, Danger will do this for you.
2. Prepare your MR for database review according to the docs.
3. Assign and mention the database reviewer suggested by Reviewer Roulette.

The following files require a review from the Database team:

• lib/gitlab/sql/set_operator.rb

Documentation review

The following files require a review from a technical writer:

• doc/development/sql.md

The review does not need to block merging this merge request. See the:

• Metadata for the *.md files that you've changed. The first few lines of each *.md file identify the stage and group most closely associated with your docs change.
• The Technical Writer assigned for that stage and group.
• Documentation workflows for information on when to assign a merge request for review.

Reviewer roulette

Changes that require review have been detected!

Please refer to the table below for assigning reviewers and maintainers suggested by Danger in the specified category:

Category	Reviewer	Maintainer
backend	Alishan 'Ali' Ladhani (@ali-gitlab) (UTC-4, 6 hours behind @ahegyi)	Mayra Cabrera (@mayra-cabrera) (UTC-5, 7 hours behind @ahegyi)
database	Nikola Milojevic (@nmilojevic1) (UTC+2, same timezone as @ahegyi)	Steve Abrams (@sabrams) (UTC-6, 8 hours behind @ahegyi)

To spread load more evenly across eligible reviewers, Danger has picked a candidate for each review slot, based on their timezone. Feel free to override these selections if you think someone else would be better-suited or use the GitLab Review Workload Dashboard to find other available reviewers.

To read more on how to use the reviewer roulette, please take a look at the Engineering workflow and code review guidelines. Please consider assigning a reviewer or maintainer who is a domain expert in the area of the merge request.

Once you've decided who will review this merge request, assign them as a reviewer! Danger does not automatically notify them for you.

If needed, you can retry the danger-review job that generated this comment.

Generated by Danger

changed the description

removed backend databasereview pending documentation labels

added typemaintenance label

added typefeature label

added 1 commit

• 02d4abd4 - Ensure even select values in UNION query

Compare with previous version

added databasereview pending label

added backend documentation labels

added 1 commit

• de6a434d - Ensure even select values in UNION query

Compare with previous version

Setting label groupoptimize based on @ahegyi's group.

added groupoptimize label

Setting label(s) devopsmanage sectiondev based on groupoptimize.

added devopsmanage sectiondev labels

added 1 commit

• 4c23320a - Ensure even select values in UNION query

Compare with previous version

added 24 commits

• 4c23320a...e7a075f7 - 23 commits from branch master
• 8184586b - Ensure even select values in UNION query

Compare with previous version

marked this merge request as ready

Hi @dstull, @stanhu!

I'm trying to come up with a strategy for detecting and fixing dangerous UNION queries. WDYT about this approach?

mentioned in issue gitlab-com/gl-infra/production#5171 (closed)

fyi - I've mentioned this in the Corrective Actions on gitlab-com/gl-infra/production#5171 (closed) - please feel free to remove/edit that entry if needed.

changed title from Ensure even select values in UNION query to Ensure even select values in UNION query [RUN AS-IF-FOSS]

added 1 commit

• 5dcb04e0 - Apply reviewer feedback

Compare with previous version

Thanks for the suggestions @smcgivern, I applied them.

Hi @msedlakjakubowski, could you do the documentation review?

requested review from @msedlakjakubowski

Hi @Quintasan, could you do the DB review?

requested review from @Quintasan

added 66 commits

• 5dcb04e0...e1696da0 - 64 commits from branch master
• de41e950 - Ensure even select values in UNION query
• 0ba8a000 - Apply reviewer feedback

Compare with previous version

removed review request for @Quintasan

mentioned in issue gitlab-com/www-gitlab-com#8084 (closed)

added 1 commit

• 770c779c - Apply reviewer feedback

Compare with previous version

added 147 commits

• 770c779c...235dd4e6 - 145 commits from branch master
• 58a8be4c - Ensure even select values in UNION query
• 11ac205e - Apply reviewer feedback

Compare with previous version

approved this merge request

added databasereviewed label and removed databasereview pending label

requested review from @mayra-cabrera