Merge branch 'security/sh-fix-jenkins-deprecated-service-ssrf' into 'master'

Fix Service Side Request Forgery in JenkinsDeprecatedService

See merge request gitlab-org/security/gitlab!179

ee/app/models/project_services/jenkins_deprecated_service.rb

@@ -83,6 +83,8 @@ class JenkinsDeprecatedService < CiService
 
   def calculate_reactive_cache(sha, ref)
     { commit_status: read_commit_status(sha, ref) }
+  rescue Gitlab::HTTP::BlockedUrlError => ex
+    Gitlab::ErrorTracking.track_exception(ex)
   end
 
   private
@@ -91,14 +93,14 @@ class JenkinsDeprecatedService < CiService
     parsed_url = URI.parse(build_page(sha, ref))
 
     if parsed_url.userinfo.blank?
-      response = Gitlab::HTTP.get(build_page(sha, ref), verify: false, allow_local_requests: true)
+      response = Gitlab::HTTP.get(build_page(sha, ref), verify: false)
     else
       get_url = build_page(sha, ref).gsub("#{parsed_url.userinfo}@", "")
       auth = {
         username: CGI.unescape(parsed_url.user),
         password: CGI.unescape(parsed_url.password)
       }
-      response = Gitlab::HTTP.get(get_url, verify: false, basic_auth: auth, allow_local_requests: true)
+      response = Gitlab::HTTP.get(get_url, verify: false, basic_auth: auth)
     end
 
     if response.code == 200

ee/changelogs/unreleased/security-sh-fix-jenkins-deprecated-service-ssrf.yml

+---
+title: Fix Service Side Request Forgery in JenkinsDeprecatedService
+merge_request:
+author:
+type: security

ee/spec/models/project_services/jenkins_deprecated_service_spec.rb

@@ -60,6 +60,35 @@ ICON_STATUS_HTML
           expect(@service.calculate_reactive_cache('2ab7834c', 'master')).to eq(commit_status: :error)
         end
       end
+
+      describe 'respects outbound network setting' do
+        let(:url) { 'http://127.0.0.1:8080/job/test' }
+
+        before do
+          stub_application_setting(allow_local_requests_from_web_hooks_and_services: setting)
+          allow(@service).to receive(:project_url).and_return(url)
+        end
+
+        context 'when local requests are allowed' do
+          let(:setting) { true }
+
+          it "makes an outbound request" do
+            stub_request(:get, 'http://127.0.0.1:8080/job/test/scm/bySHA1/2ab7834c').to_return(status: 200, body: status_body_for_icon('blue.png'), headers: {})
+
+            expect(@service.calculate_reactive_cache('2ab7834c', 'master')).to eq(commit_status: 'success')
+          end
+        end
+
+        context 'when local requests are not allowed' do
+          let(:setting) { false }
+
+          it 'raises an exception' do
+            expect(Gitlab::ErrorTracking).to receive(:track_exception).with(an_instance_of(Gitlab::HTTP::BlockedUrlError)).and_call_original
+
+            expect { @service.calculate_reactive_cache('2ab7834c', 'master') }.not_to raise_error
+          end
+        end
+      end
     end
 
     describe '#commit_status' do