Commit 56a23cce authored by Vasilii Iakliushin's avatar Vasilii Iakliushin Committed by John T Skarbek

Do not expose pull mirror username and password

Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/230864

* Remove password value from the pull mirror form
* Hide username from mirror url
parent 1b32041f
...@@ -13,4 +13,4 @@ ...@@ -13,4 +13,4 @@
.form-group .form-group
.well-password-auth.collapse.js-well-password-auth .well-password-auth.collapse.js-well-password-auth
= f.label :password, _("Password"), class: "label-bold" = f.label :password, _("Password"), class: "label-bold"
= f.password_field :password, value: mirror.password, class: 'form-control gl-form-input qa-password', autocomplete: 'new-password' = f.password_field :password, class: 'form-control gl-form-input qa-password', autocomplete: 'new-password'
...@@ -20,7 +20,7 @@ ...@@ -20,7 +20,7 @@
%template.js-pull-mirrors-form %template.js-pull-mirrors-form
= f.hidden_field :mirror, value: '1' = f.hidden_field :mirror, value: '1'
= f.hidden_field :username_only_import_url, class: 'js-mirror-url-hidden', required: true, pattern: "(#{protocols}):\/\/.+" = f.hidden_field :username_only_import_url, class: 'js-mirror-url-hidden', required: true, pattern: "(#{protocols}):\/\/.+", value: ''
= f.hidden_field :only_mirror_protected_branches, class: 'js-mirror-protected-hidden' = f.hidden_field :only_mirror_protected_branches, class: 'js-mirror-protected-hidden'
= f.fields_for :import_data, import_data, include_id: false do |import_form| = f.fields_for :import_data, import_data, include_id: false do |import_form|
......
---
title: Do not expose pull mirror username and password
merge_request:
author:
type: security
...@@ -50,10 +50,11 @@ RSpec.describe 'Project settings > [EE] repository' do ...@@ -50,10 +50,11 @@ RSpec.describe 'Project settings > [EE] repository' do
context 'mirrored external repo', :js do context 'mirrored external repo', :js do
let(:personal_access_token) { '461171575b95eeb61fba5face8ab838853d0121f' } let(:personal_access_token) { '461171575b95eeb61fba5face8ab838853d0121f' }
let(:password) { 'my-secret-pass' }
let(:external_project) do let(:external_project) do
create(:project_empty_repo, create(:project_empty_repo,
:mirror, :mirror,
import_url: "https://#{personal_access_token}@github.com/testngalog2/newrepository.git") import_url: "https://#{personal_access_token}:#{password}@github.com/testngalog2/newrepository.git")
end end
before do before do
...@@ -65,7 +66,14 @@ RSpec.describe 'Project settings > [EE] repository' do ...@@ -65,7 +66,14 @@ RSpec.describe 'Project settings > [EE] repository' do
mirror_url = find('.mirror-url').text mirror_url = find('.mirror-url').text
expect(mirror_url).not_to include(personal_access_token) expect(mirror_url).not_to include(personal_access_token)
expect(mirror_url).to include('https://*****@github.com/') expect(mirror_url).to include('https://*****:*****@github.com/')
end
it 'does not show password and personal access token on the page' do
page_content = page.body
expect(page_content).not_to include(password)
expect(page_content).not_to include(personal_access_token)
end end
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment