git.iko.soy/typeable/oauth2-proxy
on master help sign in
Panic with GitLab project repository auth (#1113)

* panic with GitLab project repository auth * /api/v4/projects/:id can return nil permissions Signed-off-by: Piers Harding <piers@ompka.net> * Add GitLab test for group no access Signed-off-by: Piers Harding <piers@ompka.net>

commit73d9f3809ed46fdbca09d356519626c0672ea969 authorPiers Harding <piers@ompka.net> dateFri 26 Mar 2021, 04:48 (6 years ago) parent5788beb
2 files changed+30−1
compare with master
unifiedsplit
providers/gitlab.go+6−1 providers/gitlab_test.go+24
providers/gitlab.go+6−1
@@ -329,9 +329,14 @@ func (p *GitLabProvider) addProjectsToSession(ctx context.Context, s *sessions.S
329329 if perms == nil {
330330 // use group project access as fallback
331331 perms = projectInfo.Permissions.GroupAccess
332+ // group project access is not set for this user then we give up
333+ if perms == nil {
334+ logger.Errorf("Warning: user %q has no project level access to %s", s.Email, project.Name)
335+ continue
336+ }
332337 }
333338
334− if perms.AccessLevel >= project.AccessLevel {
339+ if perms != nil && perms.AccessLevel >= project.AccessLevel {
335340 s.Groups = append(s.Groups, fmt.Sprintf("project:%s", project.Name))
336341 } else {
337342 logger.Errorf("Warning: user %q does not have the minimum required access level for project %q", s.Email, project.Name)
providers/gitlab_test.go+24
@@ -41,6 +41,7 @@ func testGitLabBackend() *httptest.Server {
4141 "groups": ["foo", "bar"]
4242 }
4343 `
44+
4445 projectInfo := `
4546 {
4647 "name": "MyProject",
@@ -56,6 +57,18 @@ func testGitLabBackend() *httptest.Server {
5657 }
5758 `
5859
60+ noAccessProjectInfo := `
61+ {
62+ "name": "NoAccessProject",
63+ "archived": false,
64+ "path_with_namespace": "no_access_group/no_access_project",
65+ "permissions": {
66+ "project_access": null,
67+ "group_access": null,
68+ }
69+ }
70+ `
71+
5972 personalProjectInfo := `
6073 {
6174 "name": "MyPersonalProject",
@@ -105,6 +118,13 @@ func testGitLabBackend() *httptest.Server {
105118 } else {
106119 w.WriteHeader(401)
107120 }
121+ case "/api/v4/projects/no_access_group/no_access_project":
122+ if r.Header["Authorization"][0] == authHeader {
123+ w.WriteHeader(200)
124+ w.Write([]byte(noAccessProjectInfo))
125+ } else {
126+ w.WriteHeader(401)
127+ }
108128 case "/api/v4/projects/my_group/my_archived_project":
109129 if r.Header["Authorization"][0] == authHeader {
110130 w.WriteHeader(200)
@@ -219,6 +239,10 @@ var _ = Describe("Gitlab Provider Tests", func() {
219239 expectedValue: nil,
220240 projects: []string{"my_group/my_project=40"},
221241 }),
242+ Entry("project membership invalid on group project, no access at all", entitiesTableInput{
243+ expectedValue: nil,
244+ projects: []string{"no_access_group/no_access_project=30"},
245+ }),
222246 Entry("project membership valid on personnal project", entitiesTableInput{
223247 expectedValue: []string{"project:my_profile/my_personal_project"},
224248 projects: []string{"my_profile/my_personal_project"},