Put ArtifactsController#index behind feature flag

app/controllers/projects/artifacts_controller.rb

@@ -16,6 +16,12 @@ class Projects::ArtifactsController < Projects::ApplicationController
   MAX_PER_PAGE = 20
 
   def index
+    # Loading artifacts is very expensive in projects with a lot of artifacts.
+    # This feature flag prevents a DOS attack vector.
+    # It should be removed only after resolving the underlying performance
+    # issues: https://gitlab.com/gitlab-org/gitlab/issues/32281
+    return head :no_content unless Feature.enabled?(:artifacts_management_page, @project)
+
     finder = ArtifactsFinder.new(@project, artifacts_params)
     all_artifacts = finder.execute
 

spec/controllers/projects/artifacts_controller_spec.rb

@@ -23,6 +23,11 @@ describe Projects::ArtifactsController do
   describe 'GET index' do
     subject { get :index, params: { namespace_id: project.namespace, project_id: project } }
 
+    context 'when feature flag is on' do
+      before do
+        stub_feature_flags(artifacts_management_page: true)
+      end
+
       it 'sets the artifacts variable' do
         subject
 
@@ -48,6 +53,31 @@ describe Projects::ArtifactsController do
       end
     end
 
+    context 'when feature flag is off' do
+      before do
+        stub_feature_flags(artifacts_management_page: false)
+      end
+
+      it 'renders no content' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:no_content)
+      end
+
+      it 'does not set the artifacts variable' do
+        subject
+
+        expect(assigns(:artifacts)).to eq(nil)
+      end
+
+      it 'does not set the total size variable' do
+        subject
+
+        expect(assigns(:total_size)).to eq(nil)
+      end
+    end
+  end
+
   describe 'DELETE destroy' do
     let!(:artifact) { job.job_artifacts.erasable.first }