fix :file_path - add requirements:

changelogs/unreleased/31470-fix-api-files-raw.yml

+---
+title: Fix the /projects/:id/repository/files/:file_path/raw endpoint to handle dots in the file_path
+merge_request: 13512
+author: mahcsig
+type: fixed

lib/api/files.rb

 module API
   class Files < Grape::API
+    FILE_ENDPOINT_REQUIREMENTS = API::PROJECT_ENDPOINT_REQUIREMENTS.merge(file_path: API::NO_SLASH_URL_PART_REGEX)
+
     # Prevents returning plain/text responses for files with .txt extension
     after_validation { content_type "application/json" }
 
@@ -58,13 +60,13 @@ module API
     params do
       requires :id, type: String, desc: 'The project ID'
     end
-    resource :projects, requirements: { id: %r{[^/]+} } do
+    resource :projects, requirements: FILE_ENDPOINT_REQUIREMENTS do
       desc 'Get raw file contents from the repository'
       params do
         requires :file_path, type: String, desc: 'The url encoded path to the file. Ex. lib%2Fclass%2Erb'
         requires :ref, type: String, desc: 'The name of branch, tag commit'
       end
-      get ":id/repository/files/:file_path/raw" do
+      get ":id/repository/files/:file_path/raw", requirements: FILE_ENDPOINT_REQUIREMENTS do
         assign_file_vars!
 
         send_git_blob @repo, @blob
@@ -75,7 +77,7 @@ module API
         requires :file_path, type: String, desc: 'The url encoded path to the file. Ex. lib%2Fclass%2Erb'
         requires :ref, type: String, desc: 'The name of branch, tag or commit'
       end
-      get ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      get ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         assign_file_vars!
 
         {
@@ -95,7 +97,7 @@ module API
       params do
         use :extended_file_params
       end
-      post ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      post ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         authorize! :push_code, user_project
 
         file_params = declared_params(include_missing: false)
@@ -113,7 +115,7 @@ module API
       params do
         use :extended_file_params
       end
-      put ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      put ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         authorize! :push_code, user_project
 
         file_params = declared_params(include_missing: false)
@@ -137,7 +139,7 @@ module API
       params do
         use :simple_file_params
       end
-      delete ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      delete ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         authorize! :push_code, user_project
 
         file_params = declared_params(include_missing: false)

spec/requests/api/files_spec.rb

@@ -125,6 +125,15 @@ describe API::Files do
         expect(response).to have_http_status(200)
       end
 
+      it 'returns raw file info for files with dots' do
+        url = route('.gitignore') + "/raw"
+        expect(Gitlab::Workhorse).to receive(:send_git_blob)
+
+        get api(url, current_user), params
+
+        expect(response).to have_http_status(200)
+      end
+
       it 'returns file by commit sha' do
         # This file is deleted on HEAD
         file_path = "files%2Fjs%2Fcommit%2Ejs%2Ecoffee"