Merge branch '827-fix-numeric-hostnames-in-gitlab-pages' into 'master'

Update validates_hostname to 1.0.6 to fix a bug in parsing hexadecimal-looking domain names

validates_hostname <= 1.0.5 has a bug that breaks hostnames that could be interpreted as hexadecimal numbers. This is fixed in https://github.com/KimNorgaard/validates_hostname/pull/7

Update our version of the gem to one that includes this fix, and add a test for it.

/cc @cpallares @0x7cc

Can we get this into 8.15 do you think?

Closes #827

See merge request !982

Gemfile

@@ -47,7 +47,7 @@ gem 'attr_encrypted', '~> 3.0.0'
 gem 'u2f', '~> 0.2.1'
 
 # GitLab Pages
-gem 'validates_hostname', '~> 1.0.0'
+gem 'validates_hostname', '~> 1.0.6'
 
 # Browser detection
 gem 'browser', '~> 2.2'

Gemfile.lock

@@ -789,7 +789,7 @@ GEM
       get_process_mem (~> 0)
       unicorn (>= 4, < 6)
     uniform_notifier (1.10.0)
-    validates_hostname (1.0.5)
+    validates_hostname (1.0.6)
       activerecord (>= 3.0)
       activesupport (>= 3.0)
     version_sorter (2.1.0)
@@ -1010,7 +1010,7 @@ DEPENDENCIES
   unf (~> 0.1.4)
   unicorn (~> 5.1.0)
   unicorn-worker-killer (~> 0.4.4)
-  validates_hostname (~> 1.0.0)
+  validates_hostname (~> 1.0.6)
   version_sorter (~> 2.1.0)
   virtus (~> 1.0.1)
   vmstat (~> 2.2)

changelogs/unreleased-ee/827-fix-numeric-hostnames-in-gitlab-pages.yml

+---
+title: Update validates_hostname to 1.0.6 to fix a bug in parsing hexadecimal-looking
+  domain names
+merge_request: 982
+author: 

spec/models/pages_domain_spec.rb

@@ -4,7 +4,7 @@ describe PagesDomain, models: true do
   describe 'associations' do
     it { is_expected.to belong_to(:project) }
   end
-  
+
   describe :validate_domain do
     subject { build(:pages_domain, domain: domain) }
 
@@ -20,6 +20,12 @@ describe PagesDomain, models: true do
       it { is_expected.to be_valid }
     end
 
+    context 'valid hexadecimal-looking domain' do
+      let(:domain) { '0x12345.com'}
+
+      it { is_expected.to be_valid }
+    end
+
     context 'no domain' do
       let(:domain) { nil }