Commit f059837f authored by Vasilii Iakliushin's avatar Vasilii Iakliushin

Verify project id in API

* Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/351520
* Sentry error:
https://sentry.gitlab.net/gitlab/gitlabcom/issues/3184048

**Problem**

It is possible to skip Grape validation for id for http OPTIONS
method.

**Solution**

Verify that id is present

Changelog: fixed
parent d088bff9
...@@ -117,6 +117,8 @@ module API ...@@ -117,6 +117,8 @@ module API
# rubocop: disable CodeReuse/ActiveRecord # rubocop: disable CodeReuse/ActiveRecord
def find_project(id) def find_project(id)
return unless id
projects = Project.without_deleted projects = Project.without_deleted
if id.is_a?(Integer) || id =~ /^\d+$/ if id.is_a?(Integer) || id =~ /^\d+$/
......
...@@ -76,6 +76,12 @@ RSpec.describe API::Helpers do ...@@ -76,6 +76,12 @@ RSpec.describe API::Helpers do
expect(subject.find_project(non_existing_id)).to be_nil expect(subject.find_project(non_existing_id)).to be_nil
end end
end end
context 'when project id is not provided' do
it 'returns nil' do
expect(subject.find_project(nil)).to be_nil
end
end
end end
context 'when ID is used as an argument' do context 'when ID is used as an argument' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment