2025-08-20 16:30:26 +00:00 · 2021-10-22 06:10:16 +00:00
parent 8ae8814fd7
commit 054cda9ea6
16 changed files with 94 additions and 51 deletions
--- a/config/feature_flags/development/security_finding_build_disable_joins.yml
+++ b/config/feature_flags/development/security_finding_build_disable_joins.yml
@ -0,0 +1,8 @@
+---
+name: security_finding_build_disable_joins
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/72738
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/342380
+milestone: '14.4'
+type: development
+group: group::threat insights
+default_enabled: true
--- a/doc/ci/yaml/index.md
+++ b/doc/ci/yaml/index.md
@ -2774,7 +2774,7 @@ Files matched by [`artifacts:untracked`](#artifactsuntracked) can be excluded us
 Use `expire_in` to specify how long [job artifacts](../pipelines/job_artifacts.md) are stored before
 they expire and are deleted. The `expire_in` setting does not affect:

- Artifacts from the latest job, unless this keeping the latest job artifacts is:
+- Artifacts from the latest job, unless keeping the latest job artifacts is:
  - [Disabled at the project level](../pipelines/job_artifacts.md#keep-artifacts-from-most-recent-successful-jobs).
  - [Disabled instance-wide](../../user/admin_area/settings/continuous_integration.md#keep-the-latest-artifacts-for-all-jobs-in-the-latest-successful-pipelines).
 - [Pipeline artifacts](../pipelines/pipeline_artifacts.md). It's not possible to specify an
--- a/doc/development/application_slis/rails_request_apdex.md
+++ b/doc/development/application_slis/rails_request_apdex.md
@ -14,7 +14,7 @@ groups](../stage_group_dashboards.md#error-budget) or service
 monitoring. This is being worked on in [this
 project](https://gitlab.com/groups/gitlab-com/gl-infra/-/epics/573).

-The request apdex SLI is [an SLI defined in the application](index.md)
+The request apdex SLI (Service Level Indicator) is [an SLI defined in the application](index.md)
 that measures the duration of successful requests as an indicator for
 application performance. This includes the REST and GraphQL API, and the
 regular controller endpoints. It consists of these counters:
--- a/doc/development/testing_guide/frontend_testing.md
+++ b/doc/development/testing_guide/frontend_testing.md
@ -423,7 +423,8 @@ it('passes', () => {
 ### Waiting in tests

 Sometimes a test needs to wait for something to happen in the application before it continues.
-Avoid using [`setTimeout`](https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/setTimeout)
+Avoid using [`setTimeout`](https://developer.mozilla.org/en-US/docs/Web/API/setTimeout)
+
 because it makes the reason for waiting unclear. Instead use one of the following approaches.

 #### Promises and Ajax calls
--- a/doc/install/google_cloud_platform/index.md
+++ b/doc/install/google_cloud_platform/index.md
@ -10,9 +10,11 @@ description: 'Learn how to install a GitLab instance on Google Cloud Platform.'
 This guide will help you install GitLab on a [Google Cloud Platform (GCP)](https://cloud.google.com/) using the official GitLab Linux package. You should customize it to accommodate your needs.

 NOTE:
-Google provides a whitepaper for [deploying production-ready GitLab on
-Google Kubernetes Engine](https://cloud.google.com/architecture/deploying-production-ready-gitlab-on-gke),
-including all steps and external resource configuration. These are an alternative to using a GCP VM, and use
+To deploy production-ready GitLab on
+Google Kubernetes Engine,
+you can follow Google Cloud Platform's
+[Click to Deploy steps](https://github.com/GoogleCloudPlatform/click-to-deploy/blob/master/k8s/gitlab/README.md)
+It's an alternative to using a GCP VM, and uses
 the [Cloud native GitLab Helm chart](https://docs.gitlab.com/charts/).

 ## Prerequisites
--- a/doc/integration/salesforce.md
+++ b/doc/integration/salesforce.md
@ -11,7 +11,7 @@ You can integrate your GitLab instance with [Salesforce](https://www.salesforce.
 ## Create a Salesforce Connected App

 To enable Salesforce OmniAuth provider, you must use Salesforce's credentials for your GitLab instance.
-To get the credentials (a pair of Client ID and Client Secret), you must [create a Connected App](https://help.salesforce.com/articleView?id=connected_app_create.htm&type=5) on Salesforce.
+To get the credentials (a pair of Client ID and Client Secret), you must [create a Connected App](https://help.salesforce.com/s/articleView?id=connected_app_create.htm&type=5) on Salesforce.

 1. Sign in to [Salesforce](https://login.salesforce.com/).

--- a/doc/integration/security_partners/index.md
+++ b/doc/integration/security_partners/index.md
@ -18,7 +18,7 @@ each security partner:
 - [Checkmarx](https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1929937052/GitLab+Integration)
 - [Deepfactor](https://docs.deepfactor.io/hc/en-us/articles/1500008981941)
 - [GrammaTech](https://www.grammatech.com/codesonar-gitlab-integration)
- [Indeni](https://indeni.com/doc-indeni-cloudrail/integrate-with-ci-cd/gitlab-instructions/)
+- [Indeni](https://cloudrail.app/doc/integrate-with-ci-cd/gitlab-instructions/)
 - [JScrambler](https://docs.jscrambler.com/code-integrity/documentation/gitlab-ci-integration)
 - [Semgrep](https://semgrep.dev/for/gitlab)
 - [StackHawk](https://docs.stackhawk.com/continuous-integration/gitlab.html)
--- a/doc/update/zero_downtime.md
+++ b/doc/update/zero_downtime.md
@ -100,6 +100,8 @@ Before following these instructions, note the following **important** informatio
  these instructions, **it is not possible to always achieve true zero downtime
  updates**. Users may see some connections timeout or be refused for a few minutes,
  depending on which services need to restart.
+- On Omnibus deployments, the `/etc/gitlab/gitlab.rb` configuration file must **not** have
+  `gitlab_rails['auto_migrate'] = true`.

 1. Create an empty file at `/etc/gitlab/skip-auto-reconfigure`. This prevents upgrades from running `gitlab-ctl reconfigure`, which by default automatically stops GitLab, runs all database migrations, and restarts GitLab.

@ -208,7 +210,9 @@ load balancer to latest GitLab version.
       If you are an Enterprise Edition user, replace `gitlab-ce` with
       `gitlab-ee` in the above command.

-    1. Get the regular migrations and latest code in place:
+    1. Get the regular migrations and latest code in place. Before running this step,
+       the deploy node's `/etc/gitlab/gitlab.rb` configuration file must have
+       `gitlab_rails['auto_migrate'] = true` to permit regular migrations.

       ```shell
       sudo SKIP_POST_DEPLOYMENT_MIGRATIONS=true gitlab-ctl reconfigure
--- a/doc/user/application_security/index.md
+++ b/doc/user/application_security/index.md
@ -338,6 +338,22 @@ For more details about which findings or vulnerabilities you can view in each of
 - Link it to an existing issue.
 - [Resolve the vulnerability](vulnerabilities/index.md#resolve-a-vulnerability), if a solution is known.

+## Security scanning configuration tips
+
+Each GitLab security scanning tool has a default
+[CI/CD configuration file](https://gitlab.com/gitlab-org/gitlab/-/tree/master/lib/gitlab/ci/templates/Security),
+also known as a _template_.
+
+When customizing the configuration:
+
+- [Include](../../ci/yaml/index.md#include) the scanning tool's CI/CD template. Don't _copy_ the content
+  of the template.
+- Use the [stable](../../development/cicd/templates.md#stable-version) version of each template
+  for production workflows. The stable version changes less often, and breaking changes are only
+  made between major GitLab versions. The [latest](../../development/cicd/templates.md#latest-version)
+  version contains the most recent changes, but may have significant changes between minor GitLab versions.
+- Only override values in the template as needed. All other values are inherited from the template.
+
 ## Troubleshooting

 ### Secure job failing with exit code 1
--- a/doc/user/markdown.md
+++ b/doc/user/markdown.md
@ -236,7 +236,7 @@ emojis where there is no support.

 <!-- vale gitlab.Spelling = NO -->

-On Linux, you can download [Noto Color Emoji](https://www.google.com/get/noto/help/emoji/)
+On Linux, you can download [Noto Color Emoji](https://github.com/googlefonts/noto-emoji)
 to get full native emoji support. Ubuntu 18.04 (like many modern Linux distributions) has
 this font installed by default.

--- a/doc/user/profile/account/two_factor_authentication.md
+++ b/doc/user/profile/account/two_factor_authentication.md
@ -61,7 +61,7 @@ To enable 2FA:
      - [Authenticator](https://mattrubin.me/authenticator/)
      - [andOTP](https://github.com/andOTP/andOTP)
      - [Google Authenticator](https://support.google.com/accounts/answer/1066447?hl=en)
-      - [Microsoft Authenticator](https://www.microsoft.com/en-us/account/authenticator)
+      - [Microsoft Authenticator](https://www.microsoft.com/en-us/security/mobile-authenticator-app)
      - [SailOTP](https://openrepos.net/content/seiichiro0185/sailotp)
   1. In the application, add a new entry in one of two ways:
      - Scan the code presented in GitLab with your device's camera to add the
--- a/doc/user/project/import/github.md
+++ b/doc/user/project/import/github.md
@ -67,7 +67,7 @@ For this association to succeed, each GitHub author and assignee in the reposito
 must meet one of the following conditions prior to the import:

 - Have previously logged in to a GitLab account using the GitHub icon.
- Have a GitHub account with a [public-facing email address](https://docs.github.com/en/github/setting-up-and-managing-your-github-user-account/managing-email-preferences/setting-your-commit-email-address)
+- Have a GitHub account with a [public-facing email address](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-user-account/managing-email-preferences/setting-your-commit-email-address)
  that matches their GitLab account's email address.

  NOTE:
--- a/spec/support/database/cross-database-modification-allowlist.yml
+++ b/spec/support/database/cross-database-modification-allowlist.yml
@ -5,8 +5,16 @@
 - "./ee/spec/features/groups/analytics/cycle_analytics/filters_and_data_spec.rb"
 - "./ee/spec/features/projects/services/user_activates_github_spec.rb"
 - "./ee/spec/frontend/fixtures/analytics/value_streams.rb"
- "./ee/spec/graphql/mutations/dast_on_demand_scans/create_spec.rb"
+- "./ee/spec/frontend/fixtures/analytics/value_streams_code_stage.rb"
+- "./ee/spec/frontend/fixtures/analytics/value_streams_issue_stage.rb"
+- "./ee/spec/frontend/fixtures/analytics/value_streams_plan_stage.rb"
+- "./ee/spec/frontend/fixtures/analytics/value_streams_review_stage.rb"
+- "./ee/spec/frontend/fixtures/analytics/value_streams_staging_stage.rb"
+- "./ee/spec/frontend/fixtures/analytics/value_streams_test_stage.rb"
+- "./ee/spec/graphql/mutations/dast/profiles/create_spec.rb"
 - "./ee/spec/graphql/mutations/dast/profiles/run_spec.rb"
+- "./ee/spec/graphql/mutations/dast/profiles/update_spec.rb"
+- "./ee/spec/graphql/mutations/dast_on_demand_scans/create_spec.rb"
 - "./ee/spec/graphql/mutations/merge_requests/accept_spec.rb"
 - "./ee/spec/lib/analytics/devops_adoption/snapshot_calculator_spec.rb"
 - "./ee/spec/lib/gitlab/ci/templates/Jobs/dast_default_branch_gitlab_ci_yaml_spec.rb"
@ -25,10 +33,12 @@
 - "./ee/spec/models/group_member_spec.rb"
 - "./ee/spec/models/merge_request_spec.rb"
 - "./ee/spec/models/project_spec.rb"
- "./ee/spec/requests/api/graphql/mutations/dast_on_demand_scans/create_spec.rb"
+- "./ee/spec/replicators/geo/pipeline_artifact_replicator_spec.rb"
+- "./ee/spec/replicators/geo/terraform_state_version_replicator_spec.rb"
 - "./ee/spec/requests/api/graphql/mutations/dast/profiles/create_spec.rb"
 - "./ee/spec/requests/api/graphql/mutations/dast/profiles/run_spec.rb"
 - "./ee/spec/requests/api/graphql/mutations/dast/profiles/update_spec.rb"
+- "./ee/spec/requests/api/graphql/mutations/dast_on_demand_scans/create_spec.rb"
 - "./ee/spec/requests/api/graphql/project/pipeline/dast_profile_spec.rb"
 - "./ee/spec/requests/api/graphql/project/pipelines/dast_profile_spec.rb"
 - "./ee/spec/services/app_sec/dast/profiles/create_service_spec.rb"
@ -41,6 +51,7 @@
 - "./ee/spec/services/ci/destroy_pipeline_service_spec.rb"
 - "./ee/spec/services/ci/minutes/track_live_consumption_service_spec.rb"
 - "./ee/spec/services/ci/minutes/update_build_minutes_service_spec.rb"
+- "./ee/spec/services/ci/retry_build_service_spec.rb"
 - "./ee/spec/services/ci/subscribe_bridge_service_spec.rb"
 - "./ee/spec/services/ci/sync_reports_to_approval_rules_service_spec.rb"
 - "./ee/spec/services/ci/trigger_downstream_subscription_service_spec.rb"
@ -51,15 +62,6 @@
 - "./ee/spec/services/projects/transfer_service_spec.rb"
 - "./ee/spec/services/security/security_orchestration_policies/rule_schedule_service_spec.rb"
 - "./ee/spec/services/vulnerability_feedback/create_service_spec.rb"
- "./ee/spec/support/shared_examples/fixtures/analytics_value_streams_shared_examples.rb"
- "./ee/spec/support/shared_examples/graphql/mutations/dast_on_demand_scans_shared_examples.rb"
- "./ee/spec/support/shared_examples/graphql/mutations/dast_on_demand_scan_with_user_abilities_shared_examples.rb"
- "./ee/spec/support/shared_examples/models/concerns/blob_replicator_strategy_shared_examples.rb"
- "./ee/spec/support/shared_examples/models/concerns/replicable_model_shared_examples.rb"
- "./ee/spec/support/shared_examples/models/concerns/verifiable_replicator_shared_examples.rb"
- "./ee/spec/support/shared_examples/services/audit_event_logging_shared_examples.rb"
- "./ee/spec/support/shared_examples/services/build_execute_shared_examples.rb"
- "./ee/spec/support/shared_examples/services/dast_on_demand_scans_shared_examples.rb"
 - "./ee/spec/workers/refresh_license_compliance_checks_worker_spec.rb"
 - "./spec/controllers/abuse_reports_controller_spec.rb"
 - "./spec/controllers/admin/spam_logs_controller_spec.rb"
@ -69,8 +71,8 @@
 - "./spec/controllers/projects/jobs_controller_spec.rb"
 - "./spec/controllers/projects/merge_requests/content_controller_spec.rb"
 - "./spec/controllers/projects/merge_requests_controller_spec.rb"
- "./spec/controllers/projects/pipelines_controller_spec.rb"
 - "./spec/controllers/projects/pipelines/tests_controller_spec.rb"
+- "./spec/controllers/projects/pipelines_controller_spec.rb"
 - "./spec/controllers/projects/settings/access_tokens_controller_spec.rb"
 - "./spec/factories_spec.rb"
 - "./spec/features/cycle_analytics_spec.rb"
@ -97,11 +99,15 @@
 - "./spec/lib/gitlab/ci/pipeline/chain/seed_block_spec.rb"
 - "./spec/lib/gitlab/ci/pipeline/seed/build_spec.rb"
 - "./spec/lib/gitlab/ci/templates/5_minute_production_app_ci_yaml_spec.rb"
- "./spec/lib/gitlab/ci/templates/auto_devops_gitlab_ci_yaml_spec.rb"
 - "./spec/lib/gitlab/ci/templates/AWS/deploy_ecs_gitlab_ci_yaml_spec.rb"
 - "./spec/lib/gitlab/ci/templates/Jobs/deploy_gitlab_ci_yaml_spec.rb"
+- "./spec/lib/gitlab/ci/templates/auto_devops_gitlab_ci_yaml_spec.rb"
 - "./spec/lib/gitlab/ci/templates/managed_cluster_applications_gitlab_ci_yaml_spec.rb"
 - "./spec/lib/gitlab/data_builder/pipeline_spec.rb"
+- "./spec/lib/gitlab/email/handler/create_issue_handler_spec.rb"
+- "./spec/lib/gitlab/email/handler/create_merge_request_handler_spec.rb"
+- "./spec/lib/gitlab/email/handler/create_note_handler_spec.rb"
+- "./spec/lib/gitlab/email/handler/create_note_on_issuable_handler_spec.rb"
 - "./spec/lib/gitlab/usage_data_spec.rb"
 - "./spec/lib/peek/views/active_record_spec.rb"
 - "./spec/mailers/emails/pipelines_spec.rb"
@ -116,6 +122,8 @@
 - "./spec/models/ci/legacy_stage_spec.rb"
 - "./spec/models/ci/pipeline_schedule_spec.rb"
 - "./spec/models/ci/pipeline_spec.rb"
+- "./spec/models/ci/runner_namespace_spec.rb"
+- "./spec/models/ci/runner_project_spec.rb"
 - "./spec/models/ci/runner_spec.rb"
 - "./spec/models/ci/running_build_spec.rb"
 - "./spec/models/ci/variable_spec.rb"
@ -140,8 +148,8 @@
 - "./spec/requests/api/ci/pipelines_spec.rb"
 - "./spec/requests/api/ci/runner/runners_post_spec.rb"
 - "./spec/requests/api/ci/runners_spec.rb"
- "./spec/requests/api/commits_spec.rb"
 - "./spec/requests/api/commit_statuses_spec.rb"
+- "./spec/requests/api/commits_spec.rb"
 - "./spec/requests/api/graphql/ci/runner_spec.rb"
 - "./spec/requests/api/graphql/mutations/ci/pipeline_destroy_spec.rb"
 - "./spec/requests/api/merge_requests_spec.rb"
@ -174,8 +182,8 @@
 - "./spec/services/ci/pipeline_artifacts/coverage_report_service_spec.rb"
 - "./spec/services/ci/pipeline_artifacts/create_code_quality_mr_diff_report_service_spec.rb"
 - "./spec/services/ci/pipeline_bridge_status_service_spec.rb"
- "./spec/services/ci/pipelines/add_job_service_spec.rb"
 - "./spec/services/ci/pipeline_schedule_service_spec.rb"
+- "./spec/services/ci/pipelines/add_job_service_spec.rb"
 - "./spec/services/ci/retry_build_service_spec.rb"
 - "./spec/services/ci/update_instance_variables_service_spec.rb"
 - "./spec/services/deployments/update_environment_service_spec.rb"
@ -189,18 +197,6 @@
 - "./spec/services/resource_access_tokens/revoke_service_spec.rb"
 - "./spec/services/users/destroy_service_spec.rb"
 - "./spec/services/users/reject_service_spec.rb"
- "./spec/support/shared_contexts/email_shared_context.rb"
- "./spec/support/shared_examples/controllers/access_tokens_controller_shared_examples.rb"
- "./spec/support/shared_examples/models/atomic_internal_id_shared_examples.rb"
- "./spec/support/shared_examples/models/cluster_application_status_shared_examples.rb"
- "./spec/support/shared_examples/models/cluster_application_version_shared_examples.rb"
- "./spec/support/shared_examples/models/concerns/cron_schedulable_shared_examples.rb"
- "./spec/support/shared_examples/models/concerns/limitable_shared_examples.rb"
- "./spec/support/shared_examples/models/update_highest_role_shared_examples.rb"
- "./spec/support/shared_examples/models/update_project_statistics_shared_examples.rb"
- "./spec/support/shared_examples/models/with_uploads_shared_examples.rb"
- "./spec/support/shared_examples/requests/api/status_shared_examples.rb"
- "./spec/support/shared_examples/workers/idempotency_shared_examples.rb"
 - "./spec/views/projects/artifacts/_artifact.html.haml_spec.rb"
 - "./spec/views/projects/pipeline_schedules/_pipeline_schedule.html.haml_spec.rb"
 - "./spec/views/shared/runners/_runner_details.html.haml_spec.rb"
--- a/spec/support/database/prevent_cross_database_modification.rb
+++ b/spec/support/database/prevent_cross_database_modification.rb
@ -122,7 +122,7 @@ RSpec.configure do |config|
  # Using before and after blocks because the around block causes problems with the let_it_be
  # record creations. It makes an extra savepoint which breaks the transaction count logic.
  config.before do |example_file|
-    if CROSS_DB_MODIFICATION_ALLOW_LIST.exclude?(example_file.file_path)
+    if CROSS_DB_MODIFICATION_ALLOW_LIST.exclude?(example_file.file_path_rerun_argument)
      with_cross_database_modification_prevented
    end
  end
--- a/spec/support/database/prevent_cross_joins.rb
+++ b/spec/support/database/prevent_cross_joins.rb
@ -90,23 +90,13 @@ ActiveRecord::Relation.prepend(

 ALLOW_LIST = Set.new(YAML.load_file(File.join(__dir__, 'cross-join-allowlist.yml'))).freeze

-# Based on https://github.com/rspec/rspec-core/blob/d57c371ee92b16211b80ac7b0b025968438f5297/lib/rspec/core/example.rb#L96-L104,
-# but with file_path
-def example_relative_file_path(example)
-  loaded_spec_files = RSpec.configuration.loaded_spec_files
-
-  RSpec::Core::Metadata.ascending(example.metadata) do |meta|
-    break meta[:file_path] if loaded_spec_files.include?(meta[:absolute_file_path])
-  end
-end
-
 RSpec.configure do |config|
  config.include(::Database::PreventCrossJoins::SpecHelpers)

  config.around do |example|
    Thread.current[:has_cross_join_exception] = false

-    if ALLOW_LIST.include?(example_relative_file_path(example))
+    if ALLOW_LIST.include?(example.file_path_rerun_argument)
      example.run
    else
      with_cross_joins_prevented { example.run }
--- a/spec/support/patches/rspec_example_prepended_methods.rb
+++ b/spec/support/patches/rspec_example_prepended_methods.rb
@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module RSpec
+  module Core
+    module ExamplePrependedMethods
+      # Based on https://github.com/rspec/rspec-core/blob/d57c371ee92b16211b80ac7b0b025968438f5297/lib/rspec/core/example.rb#L96-L104,
+      # Same as location_rerun_argument but with line number
+      def file_path_rerun_argument
+        loaded_spec_files = RSpec.configuration.loaded_spec_files
+
+        RSpec::Core::Metadata.ascending(metadata) do |meta|
+          break meta[:file_path] if loaded_spec_files.include?(meta[:absolute_file_path])
+        end
+      end
+    end
+
+    module ExampleProcsyPrependedMethods
+      def file_path_rerun_argument
+        example.file_path_rerun_argument
+      end
+    end
+  end
+end
+
+RSpec::Core::Example.prepend(RSpec::Core::ExamplePrependedMethods)
+RSpec::Core::Example::Procsy.prepend(RSpec::Core::ExampleProcsyPrependedMethods)