Automatic merge of gitlab-org/gitlab-ce master

app/assets/javascripts/ide/components/commit_sidebar/editor_header.vue

@@ -44,7 +44,7 @@ export default {
   <div class="d-flex ide-commit-editor-header align-items-center">
     <file-icon :file-name="activeFile.name" :size="16" class="mr-2" />
     <strong class="mr-2"> {{ activeFile.path }} </strong>
-    <changed-file-icon :file="activeFile" class="ml-0" />
+    <changed-file-icon :file="activeFile" :is-centered="false" />
     <div class="ml-auto">
       <button
         v-if="!isStaged"

app/assets/javascripts/vue_shared/components/changed_file_icon.vue

@@ -37,6 +37,11 @@ export default {
       required: false,
       default: 12,
     },
+    isCentered: {
+      type: Boolean,
+      required: false,
+      default: true,
+    },
   },
   computed: {
     changedIcon() {
@@ -78,7 +83,12 @@ export default {
 </script>
 
 <template>
-  <span v-gl-tooltip.right :title="tooltipTitle" class="file-changed-icon ml-auto">
+  <span
+    v-gl-tooltip.right
+    :title="tooltipTitle"
+    :class="{ 'ml-auto': isCentered }"
+    class="file-changed-icon"
+  >
     <icon v-if="showIcon" :name="changedIcon" :size="size" :css-classes="changedIconClass" />
   </span>
 </template>

changelogs/unreleased/filter-note-parameters.yml

+---
+title: Include note in the Rails filter_parameters configuration
+merge_request: 25238
+author:
+type: other

changelogs/unreleased/web-ide-commit-header-icon-alignment-fix.yml

+---
+title: Fixed alignment of changed icon in Web IDE
+merge_request:
+author:
+type: fixed

config/application.rb

@@ -114,7 +114,7 @@ module Gitlab
     #
     # NOTE: It is **IMPORTANT** to also update gitlab-workhorse's filter when adding parameters here to not
     #       introduce another security vulnerability: https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182
-    config.filter_parameters += [/token$/, /password/, /secret/, /key$/]
+    config.filter_parameters += [/token$/, /password/, /secret/, /key$/, /^note$/, /^text$/]
     config.filter_parameters += %i(
       certificate
       encrypted_key

config/webpack.config.js

@@ -165,6 +165,7 @@ module.exports = {
             loader: 'worker-loader',
             options: {
               name: '[name].[hash:8].worker.js',
+              inline: IS_DEV_SERVER,
             },
           },
           'babel-loader',

spec/config/application_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::Application do # rubocop:disable RSpec/FilePath
+  using RSpec::Parameterized::TableSyntax
+
+  FILTERED_PARAM = ActionDispatch::Http::ParameterFilter::FILTERED
+
+  context 'when parameters are logged' do
+    describe 'rails does not leak confidential parameters' do
+      def request_for_url(input_url)
+        env = Rack::MockRequest.env_for(input_url)
+        env['action_dispatch.parameter_filter'] = described_class.config.filter_parameters
+
+        ActionDispatch::Request.new(env)
+      end
+
+      where(:input_url, :output_query) do
+        '/'                                      | {}
+        '/?safe=1'                               | { 'safe' => '1' }
+        '/?private_token=secret'                 | { 'private_token' => FILTERED_PARAM }
+        '/?mixed=1&private_token=secret'         | { 'mixed' => '1', 'private_token' => FILTERED_PARAM }
+        '/?note=secret&noteable=1&prefix_note=2' | { 'note' => FILTERED_PARAM, 'noteable' => '1', 'prefix_note' => '2' }
+        '/?note[note]=secret&target_type=1'      | { 'note' => FILTERED_PARAM, 'target_type' => '1' }
+        '/?safe[note]=secret&target_type=1'      | { 'safe' => { 'note' => FILTERED_PARAM }, 'target_type' => '1' }
+      end
+
+      with_them do
+        it { expect(request_for_url(input_url).filtered_parameters).to eq(output_query) }
+      end
+    end
+  end
+end

spec/javascripts/vue_shared/components/changed_file_icon_spec.js

@@ -5,27 +5,40 @@ import createComponent from 'spec/helpers/vue_mount_component_helper';
 describe('Changed file icon', () => {
   let vm;
 
-  beforeEach(() => {
+  function factory(props = {}) {
     const component = Vue.extend(changedFileIcon);
 
     vm = createComponent(component, {
+      ...props,
       file: {
         tempFile: false,
         changed: true,
       },
     });
-  });
+  }
 
   afterEach(() => {
     vm.$destroy();
   });
 
+  it('centers icon', () => {
+    factory({
+      isCentered: true,
+    });
+
+    expect(vm.$el.classList).toContain('ml-auto');
+  });
+
   describe('changedIcon', () => {
     it('equals file-modified when not a temp file and has changes', () => {
+      factory();
+
       expect(vm.changedIcon).toBe('file-modified');
     });
 
     it('equals file-addition when a temp file', () => {
+      factory();
+
       vm.file.tempFile = true;
 
       expect(vm.changedIcon).toBe('file-addition');
@@ -34,10 +47,14 @@ describe('Changed file icon', () => {
 
   describe('changedIconClass', () => {
     it('includes file-modified when not a temp file', () => {
+      factory();
+
       expect(vm.changedIconClass).toContain('file-modified');
     });
 
     it('includes file-addition when a temp file', () => {
+      factory();
+
       vm.file.tempFile = true;
 
       expect(vm.changedIconClass).toContain('file-addition');