Merge branch 'bvl-request-forgery-protection-metrics' into 'master'

Don't modify env in request forgery protection

See merge request gitlab-org/gitlab!53609

lib/gitlab/request_forgery_protection.rb

@@ -23,7 +23,9 @@ module Gitlab
     end
 
     def self.verified?(env)
-      call(env)
+      minimal_env = env.slice('REQUEST_METHOD', 'rack.session', 'HTTP_X_CSRF_TOKEN')
+                      .merge('rack.input' => '')
+      call(minimal_env)
 
       true
     rescue ActionController::InvalidAuthenticityToken

spec/lib/gitlab/request_forgery_protection_spec.rb

@@ -52,6 +52,11 @@ RSpec.describe Gitlab::RequestForgeryProtection, :allow_forgery_protection do
   end
 
   describe '.verified?' do
+    it 'does not modify the env' do
+      env['REQUEST_METHOD'] = "GET"
+      expect { described_class.verified?(env) }.not_to change { env }
+    end
+
     context 'when the request method is GET' do
       before do
         env['REQUEST_METHOD'] = 'GET'