Merge branch 'security-prevent-guests-from-creating-issues-with-sentry-error' into 'master'

Prevent Guest users from creating issues linked to Sentry errors

See merge request gitlab-org/security/gitlab!1573

app/services/issues/base_service.rb

@@ -48,6 +48,9 @@ module Issues
       params.delete(:created_at) unless moved_issue || current_user.can?(:set_issue_created_at, project)
       params.delete(:updated_at) unless moved_issue || current_user.can?(:set_issue_updated_at, project)
 
+      # Only users with permission to handle error data can add it to issues
+      params.delete(:sentry_issue_attributes) unless current_user.can?(:update_sentry_issue, project)
+
       issue.system_note_timestamp = params[:created_at] || params[:updated_at]
     end
 

spec/services/issues/create_service_spec.rb

@@ -226,6 +226,27 @@ RSpec.describe Issues::CreateService do
         end
       end
 
+      context 'when sentry identifier is given' do
+        before do
+          sentry_attributes = { sentry_issue_attributes: { sentry_issue_identifier: 42 } }
+          opts.merge!(sentry_attributes)
+        end
+
+        it 'does not assign the sentry error' do
+          expect(issue.sentry_issue).to eq(nil)
+        end
+
+        context 'user is reporter or above' do
+          before do
+            project.add_reporter(user)
+          end
+
+          it 'assigns the sentry error' do
+            expect(issue.sentry_issue).to be_kind_of(SentryIssue)
+          end
+        end
+      end
+
       it 'executes issue hooks when issue is not confidential' do
         opts = { title: 'Title', description: 'Description', confidential: false }
 

spec/services/issues/update_service_spec.rb

@@ -82,6 +82,31 @@ RSpec.describe Issues::UpdateService, :mailer do
         expect(issue.milestone).to eq milestone
       end
 
+      context 'when sentry identifier is given' do
+        before do
+          sentry_attributes = { sentry_issue_attributes: { sentry_issue_identifier: 42 } }
+          opts.merge!(sentry_attributes)
+        end
+
+        it 'assigns the sentry error' do
+          update_issue(opts)
+
+          expect(issue.sentry_issue).to be_kind_of(SentryIssue)
+        end
+
+        context 'user is a guest' do
+          before do
+            project.add_guest(user)
+          end
+
+          it 'does not assign the sentry error' do
+            update_issue(opts)
+
+            expect(issue.sentry_issue).to eq(nil)
+          end
+        end
+      end
+
       context 'when issue type is not incident' do
         before do
           update_issue(opts)