Commit d1f5b717 authored by Rémy Coutable's avatar Rémy Coutable

Merge branch 'rs-more-public-send-whitelists-ee' into 'master'

[EE] Whitelist or fix additional `Gitlab/PublicSend` cop violations

See merge request !2662
parents 12e9b5b2 131e8854
...@@ -1183,29 +1183,33 @@ RSpec/VerifiedDoubles: ...@@ -1183,29 +1183,33 @@ RSpec/VerifiedDoubles:
GitlabSecurity/DeepMunge: GitlabSecurity/DeepMunge:
Enabled: true Enabled: true
Exclude: Exclude:
- 'spec/**/*'
- 'lib/**/*.rake' - 'lib/**/*.rake'
- 'spec/**/*'
GitlabSecurity/PublicSend: GitlabSecurity/PublicSend:
Enabled: true Enabled: true
Exclude: Exclude:
- 'spec/**/*' - 'config/**/*'
- 'db/**/*'
- 'features/**/*'
- 'lib/**/*.rake' - 'lib/**/*.rake'
- 'qa/**/*'
- 'spec/**/*'
GitlabSecurity/RedirectToParamsUpdate: GitlabSecurity/RedirectToParamsUpdate:
Enabled: true Enabled: true
Exclude: Exclude:
- 'spec/**/*'
- 'lib/**/*.rake' - 'lib/**/*.rake'
- 'spec/**/*'
GitlabSecurity/SqlInjection: GitlabSecurity/SqlInjection:
Enabled: true Enabled: true
Exclude: Exclude:
- 'spec/**/*'
- 'lib/**/*.rake' - 'lib/**/*.rake'
- 'spec/**/*'
GitlabSecurity/SystemCommandInjection: GitlabSecurity/SystemCommandInjection:
Enabled: true Enabled: true
Exclude: Exclude:
- 'spec/**/*'
- 'lib/**/*.rake' - 'lib/**/*.rake'
- 'spec/**/*'
...@@ -10,7 +10,7 @@ module IssuableActions ...@@ -10,7 +10,7 @@ module IssuableActions
def destroy def destroy
issuable.destroy issuable.destroy
destroy_method = "destroy_#{issuable.class.name.underscore}".to_sym destroy_method = "destroy_#{issuable.class.name.underscore}".to_sym
TodoService.new.public_send(destroy_method, issuable, current_user) TodoService.new.public_send(destroy_method, issuable, current_user) # rubocop:disable GitlabSecurity/PublicSend
name = issuable.human_class_name name = issuable.human_class_name
flash[:notice] = "The #{name} was successfully deleted." flash[:notice] = "The #{name} was successfully deleted."
......
...@@ -64,7 +64,7 @@ class Import::GithubController < Import::BaseController ...@@ -64,7 +64,7 @@ class Import::GithubController < Import::BaseController
end end
def import_enabled? def import_enabled?
__send__("#{provider}_import_enabled?") __send__("#{provider}_import_enabled?") # rubocop:disable GitlabSecurity/PublicSend
end end
def new_import_url def new_import_url
......
...@@ -89,7 +89,7 @@ class UploadsController < ApplicationController ...@@ -89,7 +89,7 @@ class UploadsController < ApplicationController
@uploader.retrieve_from_store!(params[:filename]) @uploader.retrieve_from_store!(params[:filename])
else else
@uploader = @model.send(upload_mount) @uploader = @model.public_send(upload_mount) # rubocop:disable GitlabSecurity/PublicSend
redirect_to @uploader.url unless @uploader.file_storage? redirect_to @uploader.url unless @uploader.file_storage?
end end
......
...@@ -128,10 +128,10 @@ module CommitsHelper ...@@ -128,10 +128,10 @@ module CommitsHelper
# avatar: true will prepend the avatar image # avatar: true will prepend the avatar image
# size: size of the avatar image in px # size: size of the avatar image in px
def commit_person_link(commit, options = {}) def commit_person_link(commit, options = {})
user = commit.send(options[:source]) user = commit.public_send(options[:source]) # rubocop:disable GitlabSecurity/PublicSend
source_name = clean(commit.send "#{options[:source]}_name".to_sym) source_name = clean(commit.public_send(:"#{options[:source]}_name")) # rubocop:disable GitlabSecurity/PublicSend
source_email = clean(commit.send "#{options[:source]}_email".to_sym) source_email = clean(commit.public_send(:"#{options[:source]}_email")) # rubocop:disable GitlabSecurity/PublicSend
person_name = user.try(:name) || source_name person_name = user.try(:name) || source_name
......
...@@ -5,7 +5,7 @@ module ImportHelper ...@@ -5,7 +5,7 @@ module ImportHelper
end end
def provider_project_link(provider, path_with_namespace) def provider_project_link(provider, path_with_namespace)
url = __send__("#{provider}_project_url", path_with_namespace) url = __send__("#{provider}_project_url", path_with_namespace) # rubocop:disable GitlabSecurity/PublicSend
link_to path_with_namespace, url, target: '_blank', rel: 'noopener noreferrer' link_to path_with_namespace, url, target: '_blank', rel: 'noopener noreferrer'
end end
......
...@@ -181,7 +181,14 @@ module IssuablesHelper ...@@ -181,7 +181,14 @@ module IssuablesHelper
end end
def assigned_issuables_count(issuable_type) def assigned_issuables_count(issuable_type)
current_user.public_send("assigned_open_#{issuable_type}_count") case issuable_type
when :issues
current_user.assigned_open_issues_count
when :merge_requests
current_user.assigned_open_merge_requests_count
else
raise ArgumentError, "invalid issuable `#{issuable_type}`"
end
end end
def issuable_filter_params def issuable_filter_params
...@@ -306,10 +313,6 @@ module IssuablesHelper ...@@ -306,10 +313,6 @@ module IssuablesHelper
cookies[:collapsed_gutter] == 'true' cookies[:collapsed_gutter] == 'true'
end end
def base_issuable_scope(issuable)
issuable.project.send(issuable.class.table_name).send(issuable_state_scope(issuable))
end
def issuable_state_scope(issuable) def issuable_state_scope(issuable)
if issuable.respond_to?(:merged?) && issuable.merged? if issuable.respond_to?(:merged?) && issuable.merged?
:merged :merged
......
...@@ -32,7 +32,18 @@ module MilestonesHelper ...@@ -32,7 +32,18 @@ module MilestonesHelper
end end
def milestone_issues_by_label_count(milestone, label, state:) def milestone_issues_by_label_count(milestone, label, state:)
milestone.issues.with_label(label.title).send(state).size issues = milestone.issues.with_label(label.title)
issues =
case state
when :opened
issues.opened
when :closed
issues.closed
else
raise ArgumentError, "invalid milestone state `#{state}`"
end
issues.size
end end
# Returns count of milestones for different states # Returns count of milestones for different states
......
...@@ -149,15 +149,16 @@ module ProjectsHelper ...@@ -149,15 +149,16 @@ module ProjectsHelper
# Don't show option "everyone with access" if project is private # Don't show option "everyone with access" if project is private
options = project_feature_options options = project_feature_options
level = @project.project_feature.public_send(field) # rubocop:disable GitlabSecurity/PublicSend
if @project.private? if @project.private?
level = @project.project_feature.send(field)
disabled_option = ProjectFeature::ENABLED disabled_option = ProjectFeature::ENABLED
highest_available_option = ProjectFeature::PRIVATE if level == disabled_option highest_available_option = ProjectFeature::PRIVATE if level == disabled_option
end end
options = options_for_select( options = options_for_select(
options.invert, options.invert,
selected: highest_available_option || @project.project_feature.public_send(field), selected: highest_available_option || level,
disabled: disabled_option disabled: disabled_option
) )
...@@ -519,7 +520,7 @@ module ProjectsHelper ...@@ -519,7 +520,7 @@ module ProjectsHelper
end end
def filename_path(project, filename) def filename_path(project, filename)
if project && blob = project.repository.send(filename) if project && blob = project.repository.public_send(filename) # rubocop:disable GitlabSecurity/PublicSend
project_blob_path( project_blob_path(
project, project,
tree_join(project.default_branch, blob.name) tree_join(project.default_branch, blob.name)
......
...@@ -200,7 +200,7 @@ class Commit ...@@ -200,7 +200,7 @@ class Commit
end end
def method_missing(m, *args, &block) def method_missing(m, *args, &block)
@raw.send(m, *args, &block) @raw.__send__(m, *args, &block) # rubocop:disable GitlabSecurity/PublicSend
end end
def respond_to_missing?(method, include_private = false) def respond_to_missing?(method, include_private = false)
......
...@@ -78,7 +78,7 @@ module CacheMarkdownField ...@@ -78,7 +78,7 @@ module CacheMarkdownField
def cached_html_up_to_date?(markdown_field) def cached_html_up_to_date?(markdown_field)
html_field = cached_markdown_fields.html_field(markdown_field) html_field = cached_markdown_fields.html_field(markdown_field)
cached = cached_html_for(markdown_field).present? && __send__(markdown_field).present? cached = cached_html_for(markdown_field).present? && __send__(markdown_field).present? # rubocop:disable GitlabSecurity/PublicSend
return false unless cached return false unless cached
markdown_changed = attribute_changed?(markdown_field) || false markdown_changed = attribute_changed?(markdown_field) || false
...@@ -93,14 +93,14 @@ module CacheMarkdownField ...@@ -93,14 +93,14 @@ module CacheMarkdownField
end end
def attribute_invalidated?(attr) def attribute_invalidated?(attr)
__send__("#{attr}_invalidated?") __send__("#{attr}_invalidated?") # rubocop:disable GitlabSecurity/PublicSend
end end
def cached_html_for(markdown_field) def cached_html_for(markdown_field)
raise ArgumentError.new("Unknown field: #{field}") unless raise ArgumentError.new("Unknown field: #{field}") unless
cached_markdown_fields.markdown_fields.include?(markdown_field) cached_markdown_fields.markdown_fields.include?(markdown_field)
__send__(cached_markdown_fields.html_field(markdown_field)) __send__(cached_markdown_fields.html_field(markdown_field)) # rubocop:disable GitlabSecurity/PublicSend
end end
included do included do
......
...@@ -65,7 +65,7 @@ module Elastic ...@@ -65,7 +65,7 @@ module Elastic
end end
TRACKED_FEATURE_SETTINGS.each do |feature| TRACKED_FEATURE_SETTINGS.each do |feature|
data[feature] = project_feature.public_send(feature) data[feature] = project_feature.public_send(feature) # rubocop:disable GitlabSecurity/PublicSend
end end
data data
......
...@@ -9,7 +9,7 @@ module InternalId ...@@ -9,7 +9,7 @@ module InternalId
def set_iid def set_iid
if iid.blank? if iid.blank?
parent = project || group parent = project || group
records = parent.send(self.class.name.tableize) records = parent.public_send(self.class.name.tableize) # rubocop:disable GitlabSecurity/PublicSend
records = records.with_deleted if self.paranoid? records = records.with_deleted if self.paranoid?
max_iid = records.maximum(:iid) max_iid = records.maximum(:iid)
......
...@@ -56,7 +56,7 @@ module Mentionable ...@@ -56,7 +56,7 @@ module Mentionable
end end
self.class.mentionable_attrs.each do |attr, options| self.class.mentionable_attrs.each do |attr, options|
text = __send__(attr) text = __send__(attr) # rubocop:disable GitlabSecurity/PublicSend
options = options.merge( options = options.merge(
cache_key: [self, attr], cache_key: [self, attr],
author: author, author: author,
...@@ -100,7 +100,7 @@ module Mentionable ...@@ -100,7 +100,7 @@ module Mentionable
end end
self.class.mentionable_attrs.any? do |attr, _| self.class.mentionable_attrs.any? do |attr, _|
__send__(attr) =~ reference_pattern __send__(attr) =~ reference_pattern # rubocop:disable GitlabSecurity/PublicSend
end end
end end
......
...@@ -82,7 +82,7 @@ module Participable ...@@ -82,7 +82,7 @@ module Participable
if attr.respond_to?(:call) if attr.respond_to?(:call)
source.instance_exec(current_user, ext, &attr) source.instance_exec(current_user, ext, &attr)
else else
process << source.__send__(attr) process << source.__send__(attr) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
when Enumerable, ActiveRecord::Relation when Enumerable, ActiveRecord::Relation
......
...@@ -32,6 +32,6 @@ module ProjectFeaturesCompatibility ...@@ -32,6 +32,6 @@ module ProjectFeaturesCompatibility
build_project_feature unless project_feature build_project_feature unless project_feature
access_level = Gitlab::Utils.to_boolean(value) ? ProjectFeature::ENABLED : ProjectFeature::DISABLED access_level = Gitlab::Utils.to_boolean(value) ? ProjectFeature::ENABLED : ProjectFeature::DISABLED
project_feature.send(:write_attribute, field, access_level) project_feature.__send__(:write_attribute, field, access_level) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
...@@ -246,7 +246,7 @@ class License < ActiveRecord::Base ...@@ -246,7 +246,7 @@ class License < ActiveRecord::Base
if License.column_names.include?(method_name.to_s) if License.column_names.include?(method_name.to_s)
super super
elsif license && license.respond_to?(method_name) elsif license && license.respond_to?(method_name)
license.send(method_name, *arguments, &block) license.__send__(method_name, *arguments, &block) # rubocop:disable GitlabSecurity/PublicSend
else else
super super
end end
......
...@@ -12,7 +12,7 @@ module Network ...@@ -12,7 +12,7 @@ module Network
end end
def method_missing(m, *args, &block) def method_missing(m, *args, &block)
@commit.send(m, *args, &block) @commit.__send__(m, *args, &block) # rubocop:disable GitlabSecurity/PublicSend
end end
def space def space
......
...@@ -920,14 +920,14 @@ class Project < ActiveRecord::Base ...@@ -920,14 +920,14 @@ class Project < ActiveRecord::Base
end end
def execute_hooks(data, hooks_scope = :push_hooks) def execute_hooks(data, hooks_scope = :push_hooks)
hooks.send(hooks_scope).each do |hook| hooks.public_send(hooks_scope).each do |hook| # rubocop:disable GitlabSecurity/PublicSend
hook.async_execute(data, hooks_scope.to_s) hook.async_execute(data, hooks_scope.to_s)
end end
end end
def execute_services(data, hooks_scope = :push_hooks) def execute_services(data, hooks_scope = :push_hooks)
# Call only service hooks that are active for this scope # Call only service hooks that are active for this scope
services.send(hooks_scope).each do |service| services.public_send(hooks_scope).each do |service| # rubocop:disable GitlabSecurity/PublicSend
service.async_execute(data) service.async_execute(data)
end end
end end
......
...@@ -115,7 +115,7 @@ class ChatNotificationService < Service ...@@ -115,7 +115,7 @@ class ChatNotificationService < Service
def get_channel_field(event) def get_channel_field(event)
field_name = event_channel_name(event) field_name = event_channel_name(event)
self.public_send(field_name) self.public_send(field_name) # rubocop:disable GitlabSecurity/PublicSend
end end
def build_event_channels def build_event_channels
......
...@@ -53,7 +53,7 @@ class HipchatService < Service ...@@ -53,7 +53,7 @@ class HipchatService < Service
return unless supported_events.include?(data[:object_kind]) return unless supported_events.include?(data[:object_kind])
message = create_message(data) message = create_message(data)
return unless message.present? return unless message.present?
gate[room].send('GitLab', message, message_options(data)) gate[room].send('GitLab', message, message_options(data)) # rubocop:disable GitlabSecurity/PublicSend
end end
def test(data) def test(data)
......
class ProtectableDropdown class ProtectableDropdown
REF_TYPES = %i[branches tags].freeze
def initialize(project, ref_type) def initialize(project, ref_type)
raise ArgumentError, "invalid ref type `#{ref_type}`" unless ref_type.in?(REF_TYPES)
@project = project @project = project
@ref_type = ref_type @ref_type = ref_type
end end
...@@ -16,7 +20,7 @@ class ProtectableDropdown ...@@ -16,7 +20,7 @@ class ProtectableDropdown
private private
def refs def refs
@project.repository.public_send(@ref_type) @project.repository.public_send(@ref_type) # rubocop:disable GitlabSecurity/PublicSend
end end
def ref_names def ref_names
...@@ -24,7 +28,7 @@ class ProtectableDropdown ...@@ -24,7 +28,7 @@ class ProtectableDropdown
end end
def protections def protections
@project.public_send("protected_#{@ref_type}") @project.public_send("protected_#{@ref_type}") # rubocop:disable GitlabSecurity/PublicSend
end end
def non_wildcard_protected_ref_names def non_wildcard_protected_ref_names
......
...@@ -55,7 +55,9 @@ class Repository ...@@ -55,7 +55,9 @@ class Repository
alias_method(original, name) alias_method(original, name)
define_method(name) do define_method(name) do
cache_method_output(name, fallback: fallback, memoize_only: memoize_only) { __send__(original) } cache_method_output(name, fallback: fallback, memoize_only: memoize_only) do
__send__(original) # rubocop:disable GitlabSecurity/PublicSend
end
end end
end end
...@@ -450,9 +452,9 @@ class Repository ...@@ -450,9 +452,9 @@ class Repository
def method_missing(m, *args, &block) def method_missing(m, *args, &block)
if m == :lookup && !block_given? if m == :lookup && !block_given?
lookup_cache[m] ||= {} lookup_cache[m] ||= {}
lookup_cache[m][args.join(":")] ||= raw_repository.send(m, *args, &block) lookup_cache[m][args.join(":")] ||= raw_repository.__send__(m, *args, &block) # rubocop:disable GitlabSecurity/PublicSend
else else
raw_repository.send(m, *args, &block) raw_repository.__send__(m, *args, &block) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
...@@ -783,7 +785,7 @@ class Repository ...@@ -783,7 +785,7 @@ class Repository
end end
actions.each do |options| actions.each do |options|
index.public_send(options.delete(:action), options) index.public_send(options.delete(:action), options) # rubocop:disable GitlabSecurity/PublicSend
end end
options = { options = {
......
...@@ -1093,7 +1093,7 @@ class User < ActiveRecord::Base ...@@ -1093,7 +1093,7 @@ class User < ActiveRecord::Base
# Added according to https://github.com/plataformatec/devise/blob/7df57d5081f9884849ca15e4fde179ef164a575f/README.md#activejob-integration # Added according to https://github.com/plataformatec/devise/blob/7df57d5081f9884849ca15e4fde179ef164a575f/README.md#activejob-integration
def send_devise_notification(notification, *args) def send_devise_notification(notification, *args)
return true unless can?(:receive_notifications) return true unless can?(:receive_notifications)
devise_mailer.send(notification, self, *args).deliver_later devise_mailer.__send__(notification, self, *args).deliver_later # rubocop:disable GitlabSecurity/PublicSend
end end
# This works around a bug in Devise 4.2.0 that erroneously causes a user to # This works around a bug in Devise 4.2.0 that erroneously causes a user to
......
...@@ -58,7 +58,7 @@ class AkismetService ...@@ -58,7 +58,7 @@ class AkismetService
} }
begin begin
akismet_client.public_send(type, options[:ip_address], options[:user_agent], params) akismet_client.public_send(type, options[:ip_address], options[:user_agent], params) # rubocop:disable GitlabSecurity/PublicSend
true true
rescue => e rescue => e
Rails.logger.error("Unable to connect to Akismet: #{e}, skipping!") Rails.logger.error("Unable to connect to Akismet: #{e}, skipping!")
......
...@@ -23,7 +23,7 @@ module Ci ...@@ -23,7 +23,7 @@ module Ci
end end
attributes = CLONE_ACCESSORS.map do |attribute| attributes = CLONE_ACCESSORS.map do |attribute|
[attribute, build.send(attribute)] [attribute, build.public_send(attribute)] # rubocop:disable GitlabSecurity/PublicSend
end end
attributes.push([:user, current_user]) attributes.push([:user, current_user])
......
...@@ -11,6 +11,7 @@ module Commits ...@@ -11,6 +11,7 @@ module Commits
def commit_change(action) def commit_change(action)
raise NotImplementedError unless repository.respond_to?(action) raise NotImplementedError unless repository.respond_to?(action)
# rubocop:disable GitlabSecurity/PublicSend
repository.public_send( repository.public_send(
action, action,
current_user, current_user,
......
...@@ -19,7 +19,7 @@ module Geo ...@@ -19,7 +19,7 @@ module Geo
::Gitlab::Geo.secondary_nodes.each do |node| ::Gitlab::Geo.secondary_nodes.each do |node|
next unless node.enabled? next unless node.enabled?
notify_url = node.send(notify_url_method.to_sym) notify_url = node.__send__(notify_url_method.to_sym) # rubocop:disable GitlabSecurity/PublicSend
success, details = notify(notify_url, content) success, details = notify(notify_url, content)
unless success unless success
......
...@@ -340,7 +340,7 @@ class IssuableBaseService < BaseService ...@@ -340,7 +340,7 @@ class IssuableBaseService < BaseService
def invalidate_cache_counts(issuable, users: [], skip_project_cache: false) def invalidate_cache_counts(issuable, users: [], skip_project_cache: false)
users.each do |user| users.each do |user|
user.public_send("invalidate_#{issuable.model_name.singular}_cache_counts") user.public_send("invalidate_#{issuable.model_name.singular}_cache_counts") # rubocop:disable GitlabSecurity/PublicSend
end end
unless skip_project_cache unless skip_project_cache
......
...@@ -36,7 +36,7 @@ module Members ...@@ -36,7 +36,7 @@ module Members
source.members.find_by(condition) || source.members.find_by(condition) ||
source.requesters.find_by!(condition) source.requesters.find_by!(condition)
else else
source.public_send(scope).find_by!(condition) source.public_send(scope).find_by!(condition) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
......
# rubocop:disable GitlabSecurity/PublicSend
# NotificationService class # NotificationService class
# #
# Used for notifying users with emails about different events # Used for notifying users with emails about different events
......
...@@ -6,7 +6,7 @@ class SystemHooksService ...@@ -6,7 +6,7 @@ class SystemHooksService
end end
def execute_hooks(data, hooks_scope = :all) def execute_hooks(data, hooks_scope = :all)
SystemHook.public_send(hooks_scope).find_each do |hook| SystemHook.public_send(hooks_scope).find_each do |hook| # rubocop:disable GitlabSecurity/PublicSend
hook.async_execute(data, 'system_hooks') hook.async_execute(data, 'system_hooks')
end end
end end
......
...@@ -18,7 +18,7 @@ module TestHooks ...@@ -18,7 +18,7 @@ module TestHooks
end end
error_message = catch(:validation_error) do error_message = catch(:validation_error) do
sample_data = self.__send__(trigger_data_method) sample_data = self.__send__(trigger_data_method) # rubocop:disable GitlabSecurity/PublicSend
return hook.execute(sample_data, trigger) return hook.execute(sample_data, trigger)
end end
......
...@@ -38,7 +38,7 @@ class ObjectStoreUploader < CarrierWave::Uploader::Base ...@@ -38,7 +38,7 @@ class ObjectStoreUploader < CarrierWave::Uploader::Base
end end
def real_object_store def real_object_store
subject.public_send(:"#{field}_store") subject.public_send(:"#{field}_store") # rubocop:disable GitlabSecurity/PublicSend
end end
def object_store def object_store
...@@ -47,7 +47,7 @@ class ObjectStoreUploader < CarrierWave::Uploader::Base ...@@ -47,7 +47,7 @@ class ObjectStoreUploader < CarrierWave::Uploader::Base
def object_store=(value) def object_store=(value)
@storage = nil @storage = nil
subject.public_send(:"#{field}_store=", value) subject.public_send(:"#{field}_store=", value) # rubocop:disable GitlabSecurity/PublicSend
end end
def use_file def use_file
......
...@@ -19,9 +19,9 @@ class ElasticIndexerWorker ...@@ -19,9 +19,9 @@ class ElasticIndexerWorker
record.__elasticsearch__.client = client record.__elasticsearch__.client = client
if klass.nested? if klass.nested?
record.__elasticsearch__.__send__ "#{operation}_document", parent: record.es_parent record.__elasticsearch__.__send__ "#{operation}_document", parent: record.es_parent # rubocop:disable GitlabSecurity/PublicSend
else else
record.__elasticsearch__.__send__ "#{operation}_document" record.__elasticsearch__.__send__ "#{operation}_document" # rubocop:disable GitlabSecurity/PublicSend
end end
update_issue_notes(record, options["changed_fields"]) if klass == Issue update_issue_notes(record, options["changed_fields"]) if klass == Issue
......
...@@ -4,6 +4,6 @@ class GitlabShellWorker ...@@ -4,6 +4,6 @@ class GitlabShellWorker
include DedicatedSidekiqQueue include DedicatedSidekiqQueue
def perform(action, *arg) def perform(action, *arg)
gitlab_shell.send(action, *arg) gitlab_shell.__send__(action, *arg) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
# rubocop:disable GitlabSecurity/PublicSend
require_dependency Rails.root.join('lib/gitlab') # Load Gitlab as soon as possible require_dependency Rails.root.join('lib/gitlab') # Load Gitlab as soon as possible
class Settings < Settingslogic class Settings < Settingslogic
......
...@@ -24,7 +24,7 @@ module EE ...@@ -24,7 +24,7 @@ module EE
super(options).tap do |json| super(options).tap do |json|
if milestone.present? && milestone_attrs.present? if milestone.present? && milestone_attrs.present?
json[:milestone] = milestone_attrs.each_with_object({}) do |attr, json| json[:milestone] = milestone_attrs.each_with_object({}) do |attr, json|
json[attr] = milestone.public_send(attr) json[attr] = milestone.public_send(attr) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
end end
......
...@@ -283,7 +283,7 @@ module EE ...@@ -283,7 +283,7 @@ module EE
super super
if group && feature_available?(:group_webhooks) if group && feature_available?(:group_webhooks)
group.hooks.send(hooks_scope).each do |hook| group.hooks.__send__(hooks_scope).each do |hook| # rubocop:disable GitlabSecurity/PublicSend
hook.async_execute(data, hooks_scope.to_s) hook.async_execute(data, hooks_scope.to_s)
end end
end end
......
...@@ -138,7 +138,7 @@ module API ...@@ -138,7 +138,7 @@ module API
error_classes = [MissingTokenError, TokenNotFoundError, error_classes = [MissingTokenError, TokenNotFoundError,
ExpiredError, RevokedError, InsufficientScopeError] ExpiredError, RevokedError, InsufficientScopeError]
base.send :rescue_from, *error_classes, oauth2_bearer_token_error_handler base.__send__(:rescue_from, *error_classes, oauth2_bearer_token_error_handler) # rubocop:disable GitlabSecurity/PublicSend
end end
def oauth2_bearer_token_error_handler def oauth2_bearer_token_error_handler
......
...@@ -607,8 +607,9 @@ module API ...@@ -607,8 +607,9 @@ module API
target_url = "namespace_project_#{target_type}_url" target_url = "namespace_project_#{target_type}_url"
target_anchor = "note_#{todo.note_id}" if todo.note_id? target_anchor = "note_#{todo.note_id}" if todo.note_id?
Gitlab::Routing.url_helpers.public_send(target_url, Gitlab::Routing
todo.project.namespace, todo.project, todo.target, anchor: target_anchor) .url_helpers
.public_send(target_url, todo.project.namespace, todo.project, todo.target, anchor: target_anchor) # rubocop:disable GitlabSecurity/PublicSend
end end
expose :body expose :body
......
...@@ -153,7 +153,7 @@ module API ...@@ -153,7 +153,7 @@ module API
render_api_error!('Scope contains invalid value', 400) render_api_error!('Scope contains invalid value', 400)
end end
runners.send(scope) runners.public_send(scope) # rubocop:disable GitlabSecurity/PublicSend
end end
def get_runner(id) def get_runner(id)
......
...@@ -22,7 +22,7 @@ module API ...@@ -22,7 +22,7 @@ module API
use :pagination use :pagination
end end
get ":id/#{noteables_str}/:noteable_id/notes" do get ":id/#{noteables_str}/:noteable_id/notes" do
noteable = user_project.send(noteables_str.to_sym).find(params[:noteable_id]) noteable = user_project.public_send(noteables_str.to_sym).find(params[:noteable_id]) # rubocop:disable GitlabSecurity/PublicSend
if can?(current_user, noteable_read_ability_name(noteable), noteable) if can?(current_user, noteable_read_ability_name(noteable), noteable)
# We exclude notes that are cross-references and that cannot be viewed # We exclude notes that are cross-references and that cannot be viewed
...@@ -50,7 +50,7 @@ module API ...@@ -50,7 +50,7 @@ module API
requires :noteable_id, type: Integer, desc: 'The ID of the noteable' requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
end end
get ":id/#{noteables_str}/:noteable_id/notes/:note_id" do get ":id/#{noteables_str}/:noteable_id/notes/:note_id" do
noteable = user_project.send(noteables_str.to_sym).find(params[:noteable_id]) noteable = user_project.public_send(noteables_str.to_sym).find(params[:noteable_id]) # rubocop:disable GitlabSecurity/PublicSend
note = noteable.notes.find(params[:note_id]) note = noteable.notes.find(params[:note_id])
can_read_note = can?(current_user, noteable_read_ability_name(noteable), noteable) && !note.cross_reference_not_visible_for?(current_user) can_read_note = can?(current_user, noteable_read_ability_name(noteable), noteable) && !note.cross_reference_not_visible_for?(current_user)
...@@ -76,7 +76,7 @@ module API ...@@ -76,7 +76,7 @@ module API
noteable_id: params[:noteable_id] noteable_id: params[:noteable_id]
} }
noteable = user_project.send(noteables_str.to_sym).find(params[:noteable_id]) noteable = user_project.public_send(noteables_str.to_sym).find(params[:noteable_id]) # rubocop:disable GitlabSecurity/PublicSend
if can?(current_user, noteable_read_ability_name(noteable), noteable) if can?(current_user, noteable_read_ability_name(noteable), noteable)
if params[:created_at] && (current_user.admin? || user_project.owner == current_user) if params[:created_at] && (current_user.admin? || user_project.owner == current_user)
......
...@@ -95,10 +95,10 @@ module Banzai ...@@ -95,10 +95,10 @@ module Banzai
private private
def external_issues_cached(attribute) def external_issues_cached(attribute)
return project.public_send(attribute) unless RequestStore.active? return project.public_send(attribute) unless RequestStore.active? # rubocop:disable GitlabSecurity/PublicSend
cached_attributes = RequestStore[:banzai_external_issues_tracker_attributes] ||= Hash.new { |h, k| h[k] = {} } cached_attributes = RequestStore[:banzai_external_issues_tracker_attributes] ||= Hash.new { |h, k| h[k] = {} }
cached_attributes[project.id][attribute] = project.public_send(attribute) if cached_attributes[project.id][attribute].nil? cached_attributes[project.id][attribute] = project.public_send(attribute) if cached_attributes[project.id][attribute].nil? # rubocop:disable GitlabSecurity/PublicSend
cached_attributes[project.id][attribute] cached_attributes[project.id][attribute]
end end
end end
......
...@@ -37,7 +37,7 @@ module Banzai ...@@ -37,7 +37,7 @@ module Banzai
objects.each_with_index do |object, index| objects.each_with_index do |object, index|
redacted_data = redacted[index] redacted_data = redacted[index]
object.__send__("redacted_#{attribute}_html=", redacted_data[:document].to_html.html_safe) object.__send__("redacted_#{attribute}_html=", redacted_data[:document].to_html.html_safe) # rubocop:disable GitlabSecurity/PublicSend
object.user_visible_reference_count = redacted_data[:visible_reference_count] object.user_visible_reference_count = redacted_data[:visible_reference_count]
end end
end end
......
...@@ -18,7 +18,7 @@ module Banzai ...@@ -18,7 +18,7 @@ module Banzai
define_method(meth) do |text, context| define_method(meth) do |text, context|
context = transform_context(context) context = transform_context(context)
html_pipeline.send(meth, text, context) html_pipeline.__send__(meth, text, context) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
end end
......
...@@ -43,7 +43,7 @@ module Banzai ...@@ -43,7 +43,7 @@ module Banzai
# Same as +render_field+, but without consulting or updating the cache field # Same as +render_field+, but without consulting or updating the cache field
def self.cacheless_render_field(object, field, options = {}) def self.cacheless_render_field(object, field, options = {})
text = object.__send__(field) text = object.__send__(field) # rubocop:disable GitlabSecurity/PublicSend
context = object.banzai_render_context(field).merge(options) context = object.banzai_render_context(field).merge(options)
cacheless_render(text, context) cacheless_render(text, context)
...@@ -156,7 +156,7 @@ module Banzai ...@@ -156,7 +156,7 @@ module Banzai
# method. # method.
def self.full_cache_multi_key(cache_key, pipeline_name) def self.full_cache_multi_key(cache_key, pipeline_name)
return unless cache_key return unless cache_key
Rails.cache.send(:expanded_key, full_cache_key(cache_key, pipeline_name)) Rails.cache.__send__(:expanded_key, full_cache_key(cache_key, pipeline_name)) # rubocop:disable GitlabSecurity/PublicSend
end end
# GitLab EE needs to disable updates on GET requests in Geo # GitLab EE needs to disable updates on GET requests in Geo
......
...@@ -13,7 +13,7 @@ module Bitbucket ...@@ -13,7 +13,7 @@ module Bitbucket
def method_missing(method, *args) def method_missing(method, *args)
return super unless self.respond_to?(method) return super unless self.respond_to?(method)
self.send(method, *args) do |item| self.__send__(method, *args) do |item| # rubocop:disable GitlabSecurity/PublicSend
block_given? ? yield(item) : item block_given? ? yield(item) : item
end end
end end
......
...@@ -208,7 +208,7 @@ module Ci ...@@ -208,7 +208,7 @@ module Ci
return unless command = stack.shift() return unless command = stack.shift()
if self.respond_to?("on_#{command}", true) if self.respond_to?("on_#{command}", true)
self.send("on_#{command}", stack) self.__send__("on_#{command}", stack) # rubocop:disable GitlabSecurity/PublicSend
end end
evaluate_command_stack(stack) evaluate_command_stack(stack)
......
...@@ -81,7 +81,7 @@ class CsvBuilder ...@@ -81,7 +81,7 @@ class CsvBuilder
if attribute.respond_to?(:call) if attribute.respond_to?(:call)
excel_sanitize(attribute.call(object)) excel_sanitize(attribute.call(object))
else else
excel_sanitize(object.public_send(attribute)) excel_sanitize(object.public_send(attribute)) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
end end
......
...@@ -109,7 +109,7 @@ module DeclarativePolicy ...@@ -109,7 +109,7 @@ module DeclarativePolicy
name = name.to_sym name = name.to_sym
if delegation_block.nil? if delegation_block.nil?
delegation_block = proc { @subject.__send__(name) } delegation_block = proc { @subject.__send__(name) } # rubocop:disable GitlabSecurity/PublicSend
end end
own_delegations[name] = delegation_block own_delegations[name] = delegation_block
......
...@@ -93,7 +93,7 @@ module DeclarativePolicy ...@@ -93,7 +93,7 @@ module DeclarativePolicy
def method_missing(m, *a, &b) def method_missing(m, *a, &b)
return super unless @context_class.respond_to?(m) return super unless @context_class.respond_to?(m)
@context_class.__send__(m, *a, &b) @context_class.__send__(m, *a, &b) # rubocop:disable GitlabSecurity/PublicSend
end end
def respond_to_missing?(m) def respond_to_missing?(m)
......
...@@ -44,13 +44,13 @@ class FileSizeValidator < ActiveModel::EachValidator ...@@ -44,13 +44,13 @@ class FileSizeValidator < ActiveModel::EachValidator
when Integer when Integer
check_value check_value
when Symbol when Symbol
record.send(check_value) record.public_send(check_value) # rubocop:disable GitlabSecurity/PublicSend
end end
value ||= [] if key == :maximum value ||= [] if key == :maximum
value_size = value.size value_size = value.size
next if value_size.send(validity_check, check_value) next if value_size.public_send(validity_check, check_value) # rubocop:disable GitlabSecurity/PublicSend
errors_options = options.except(*RESERVED_OPTIONS) errors_options = options.except(*RESERVED_OPTIONS)
errors_options[:file_size] = help.number_to_human_size check_value errors_options[:file_size] = help.number_to_human_size check_value
......
...@@ -103,7 +103,7 @@ module Gitlab ...@@ -103,7 +103,7 @@ module Gitlab
if Service.available_services_names.include?(underscored_service) if Service.available_services_names.include?(underscored_service)
# We treat underscored_service as a trusted input because it is included # We treat underscored_service as a trusted input because it is included
# in the Service.available_services_names whitelist. # in the Service.available_services_names whitelist.
service = project.public_send("#{underscored_service}_service") service = project.public_send("#{underscored_service}_service") # rubocop:disable GitlabSecurity/PublicSend
if service && service.activated? && service.valid_token?(password) if service && service.activated? && service.valid_token?(password)
Gitlab::Auth::Result.new(nil, project, :ci, build_authentication_abilities) Gitlab::Auth::Result.new(nil, project, :ci, build_authentication_abilities)
...@@ -151,7 +151,7 @@ module Gitlab ...@@ -151,7 +151,7 @@ module Gitlab
def abilities_for_scope(scopes) def abilities_for_scope(scopes)
scopes.map do |scope| scopes.map do |scope|
self.public_send(:"#{scope}_scope_authentication_abilities") self.public_send(:"#{scope}_scope_authentication_abilities") # rubocop:disable GitlabSecurity/PublicSend
end.flatten.uniq end.flatten.uniq
end end
......
...@@ -69,7 +69,7 @@ module Gitlab ...@@ -69,7 +69,7 @@ module Gitlab
instance_variable_set(ivar_name, {}) instance_variable_set(ivar_name, {})
end end
key = __send__(cache_key_method_name, args) key = __send__(cache_key_method_name, args) # rubocop:disable GitlabSecurity/PublicSend
store.fetch(key) { store[key] = super(*args) } store.fetch(key) { store[key] = super(*args) }
end end
......
# rubocop:disable GitlabSecurity/PublicSend
module Gitlab module Gitlab
module Database module Database
module LoadBalancing module LoadBalancing
......
# rubocop:disable GitlabSecurity/PublicSend
module Gitlab module Gitlab
module Database module Database
module LoadBalancing module LoadBalancing
......
...@@ -38,7 +38,7 @@ module Gitlab ...@@ -38,7 +38,7 @@ module Gitlab
# - The first diff line with a higher line number, if it falls between diff contexts # - The first diff line with a higher line number, if it falls between diff contexts
# - The last known diff line, if it falls after the last diff context # - The last known diff line, if it falls after the last diff context
diff_line = diff_lines.find do |diff_line| diff_line = diff_lines.find do |diff_line|
diff_from_line = diff_line.send(from) diff_from_line = diff_line.public_send(from) # rubocop:disable GitlabSecurity/PublicSend
diff_from_line && diff_from_line >= from_line diff_from_line && diff_from_line >= from_line
end end
diff_line ||= diff_lines.last diff_line ||= diff_lines.last
...@@ -47,8 +47,8 @@ module Gitlab ...@@ -47,8 +47,8 @@ module Gitlab
# mapped line number is the same as the specified line number. # mapped line number is the same as the specified line number.
return from_line unless diff_line return from_line unless diff_line
diff_from_line = diff_line.send(from) diff_from_line = diff_line.public_send(from) # rubocop:disable GitlabSecurity/PublicSend
diff_to_line = diff_line.send(to) diff_to_line = diff_line.public_send(to) # rubocop:disable GitlabSecurity/PublicSend
# If the line was removed, there is no mapped line number. # If the line was removed, there is no mapped line number.
return unless diff_to_line return unless diff_to_line
......
...@@ -84,17 +84,17 @@ module Gitlab ...@@ -84,17 +84,17 @@ module Gitlab
def self.configure_primary_jobs! def self.configure_primary_jobs!
self.enable_all_cron_jobs! self.enable_all_cron_jobs!
SECONDARY_JOBS.each { |job| self.send(job).try(:disable!) } SECONDARY_JOBS.each { |job| self.__send__(job).try(:disable!) } # rubocop:disable GitlabSecurity/PublicSend
end end
def self.configure_secondary_jobs! def self.configure_secondary_jobs!
self.disable_all_cron_jobs! self.disable_all_cron_jobs!
SECONDARY_JOBS.each { |job| self.send(job).try(:enable!) } SECONDARY_JOBS.each { |job| self.__send__(job).try(:enable!) } # rubocop:disable GitlabSecurity/PublicSend
end end
def self.disable_all_geo_jobs! def self.disable_all_geo_jobs!
PRIMARY_JOBS.each { |job| self.send(job).try(:disable!) } PRIMARY_JOBS.each { |job| self.__send__(job).try(:disable!) } # rubocop:disable GitlabSecurity/PublicSend
SECONDARY_JOBS.each { |job| self.send(job).try(:disable!) } SECONDARY_JOBS.each { |job| self.__send__(job).try(:disable!) } # rubocop:disable GitlabSecurity/PublicSend
end end
def self.disable_all_cron_jobs! def self.disable_all_cron_jobs!
......
...@@ -73,7 +73,7 @@ module Gitlab ...@@ -73,7 +73,7 @@ module Gitlab
def logout_token_cipher(salt, operation) def logout_token_cipher(salt, operation)
cipher = OpenSSL::Cipher::AES.new(128, :CBC) cipher = OpenSSL::Cipher::AES.new(128, :CBC)
cipher.send(operation) cipher.__send__(operation) # rubocop:disable GitlabSecurity/PublicSend
cipher.iv = salt cipher.iv = salt
cipher.key = Gitlab::Application.secrets.db_key_base cipher.key = Gitlab::Application.secrets.db_key_base
cipher.auth_data = '' cipher.auth_data = ''
......
...@@ -173,7 +173,7 @@ module Gitlab ...@@ -173,7 +173,7 @@ module Gitlab
def initialize(options) def initialize(options)
%w(id name path size data mode commit_id binary).each do |key| %w(id name path size data mode commit_id binary).each do |key|
self.send("#{key}=", options[key.to_sym]) self.__send__("#{key}=", options[key.to_sym]) # rubocop:disable GitlabSecurity/PublicSend
end end
@loaded_all_data = false @loaded_all_data = false
......
...@@ -89,7 +89,7 @@ module Gitlab ...@@ -89,7 +89,7 @@ module Gitlab
def initialize(options) def initialize(options)
%w(id root_id name path type mode commit_id).each do |key| %w(id root_id name path type mode commit_id).each do |key|
self.send("#{key}=", options[key.to_sym]) self.send("#{key}=", options[key.to_sym]) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
......
...@@ -55,7 +55,7 @@ module Gitlab ...@@ -55,7 +55,7 @@ module Gitlab
def self.call(storage, service, rpc, request) def self.call(storage, service, rpc, request)
metadata = request_metadata(storage) metadata = request_metadata(storage)
metadata = yield(metadata) if block_given? metadata = yield(metadata) if block_given?
stub(service, storage).send(rpc, request, metadata) stub(service, storage).__send__(rpc, request, metadata) # rubocop:disable GitlabSecurity/PublicSend
end end
def self.request_metadata(storage) def self.request_metadata(storage)
......
...@@ -11,7 +11,9 @@ module Gitlab ...@@ -11,7 +11,9 @@ module Gitlab
end end
def create! def create!
project.public_send(project_association).find_or_create_by!(find_condition) do |record| association = project.public_send(project_association) # rubocop:disable GitlabSecurity/PublicSend
association.find_or_create_by!(find_condition) do |record|
record.attributes = attributes record.attributes = attributes
end end
end end
......
...@@ -120,7 +120,7 @@ module Gitlab ...@@ -120,7 +120,7 @@ module Gitlab
def request(method, *args, &block) def request(method, *args, &block)
sleep rate_limit_sleep_time if rate_limit_exceed? sleep rate_limit_sleep_time if rate_limit_exceed?
data = api.send(method, *args) data = api.__send__(method, *args) # rubocop:disable GitlabSecurity/PublicSend
return data unless data.is_a?(Array) return data unless data.is_a?(Array)
last_response = api.last_response last_response = api.last_response
......
...@@ -289,7 +289,7 @@ module Gitlab ...@@ -289,7 +289,7 @@ module Gitlab
opts.last[:page] = current_page(resource_type) opts.last[:page] = current_page(resource_type)
client.public_send(resource_type, *opts) do |resources| client.public_send(resource_type, *opts) do |resources| # rubocop:disable GitlabSecurity/PublicSend
yield resources yield resources
increment_page(resource_type) increment_page(resource_type)
end end
......
...@@ -16,7 +16,7 @@ module Gitlab ...@@ -16,7 +16,7 @@ module Gitlab
def method_missing(name, *args, &block) def method_missing(name, *args, &block)
__evaluate__ __evaluate__
@result.__send__(name, *args, &block) @result.__send__(name, *args, &block) # rubocop:disable GitlabSecurity/PublicSend
end end
def respond_to_missing?(name, include_private = false) def respond_to_missing?(name, include_private = false)
......
...@@ -36,7 +36,7 @@ module Gitlab ...@@ -36,7 +36,7 @@ module Gitlab
end end
def uid def uid
entry.send(config.uid).first entry.public_send(config.uid).first # rubocop:disable GitlabSecurity/PublicSend
end end
def username def username
...@@ -69,7 +69,7 @@ module Gitlab ...@@ -69,7 +69,7 @@ module Gitlab
return nil unless selected_attr return nil unless selected_attr
entry.public_send(selected_attr) entry.public_send(selected_attr) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
end end
......
...@@ -23,7 +23,7 @@ module Gitlab ...@@ -23,7 +23,7 @@ module Gitlab
define_method(meth) do |text, context| define_method(meth) do |text, context|
context = transform_context(context) context = transform_context(context)
html_pipeline.send(meth, text, context) html_pipeline.__send__(meth, text, context) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
end end
......
...@@ -27,7 +27,7 @@ class UploadedFile ...@@ -27,7 +27,7 @@ class UploadedFile
alias_method :local_path, :path alias_method :local_path, :path
def method_missing(method_name, *args, &block) #:nodoc: def method_missing(method_name, *args, &block) #:nodoc:
@tempfile.__send__(method_name, *args, &block) @tempfile.__send__(method_name, *args, &block) # rubocop:disable GitlabSecurity/PublicSend
end end
def respond_to?(method_name, include_private = false) #:nodoc: def respond_to?(method_name, include_private = false) #:nodoc:
......
...@@ -21,7 +21,7 @@ module QA ...@@ -21,7 +21,7 @@ module QA
end end
def self.method_missing(name, *args) def self.method_missing(name, *args)
self.new.strategy.public_send(name, *args) self.new.strategy.public_send(name, *args) # rubocop:disable GitlabSecurity/PublicSend
end end
end end
end end
......
...@@ -24,13 +24,13 @@ describe FileSizeValidator do ...@@ -24,13 +24,13 @@ describe FileSizeValidator do
describe 'options uses a symbol' do describe 'options uses a symbol' do
let(:options) do let(:options) do
{ {
maximum: :test, maximum: :max_attachment_size,
attributes: { attachment: attachment } attributes: { attachment: attachment }
} }
end end
before do before do
allow(note).to receive(:test) { 10 } expect(note).to receive(:max_attachment_size) { 10 }
end end
it 'attachment exceeds maximum limit' do it 'attachment exceeds maximum limit' do
......
...@@ -4,6 +4,13 @@ describe ProtectableDropdown do ...@@ -4,6 +4,13 @@ describe ProtectableDropdown do
let(:project) { create(:project, :repository) } let(:project) { create(:project, :repository) }
let(:subject) { described_class.new(project, :branches) } let(:subject) { described_class.new(project, :branches) }
describe 'initialize' do
it 'raises ArgumentError for invalid ref type' do
expect { described_class.new(double, :foo) }
.to raise_error(ArgumentError, "invalid ref type `foo`")
end
end
describe '#protectable_ref_names' do describe '#protectable_ref_names' do
before do before do
project.protected_branches.create(name: 'master') project.protected_branches.create(name: 'master')
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment