[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Fix prometheus DoS through Workhorse

See merge request gitlab-org/security/gitlab!1146

Deny implicit flow for confidential apps

See merge request gitlab-org/security/gitlab!1141

Set all trusted OAuth apps as confidential

See merge request gitlab-org/security/gitlab!1152

Fix regex backtracking issue in package_name_regex

See merge request gitlab-org/security/gitlab!1111

Fix stealing API token and Prometheus DoS through GitLab Pages

See merge request gitlab-org/security/gitlab!1138

Update non-negative integer regex to protect against regex DoS

See merge request gitlab-org/security/gitlab!1133

Forbid public cache for private repos

See merge request gitlab-org/security/gitlab!1149

Fix weekly Redis HLL keys  for 13-5-stable-ee

See merge request gitlab-org/gitlab!50776

Alper Akgun authored 4 years ago and Alina Mihaila committed 4 years ago

Fix Redis HLL weekly keys

See merge request gitlab-org/gitlab!50358

Migrate all trusted apps to confidential to avoid
potential access token leak abusing implicit flow

When project is public but the repository is private, we don't
want to cache it as public. In this case, anybody will be able
to see the cached version of the private content during 60s
after an eligible user has viewed it.

Run test at a fixed time

See merge request gitlab-org/gitlab!50489

Albert Salim authored 4 years ago and Patrick Bajao committed 4 years ago

Due to how HLLRedisCounter#weekly_redis_keys converts
dates to calendar week, it would result in an empty
array when the calendar week of end_date occurs before
the calendar week of start_date.

For example, given start_date 2020-12-01 and
end_date 2021-01-01, the calendar week would be reversed,
resulting in empty array from #weekly_redis_keys

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Do not expose starred projects of users with private profile via API

See merge request gitlab-org/security/gitlab!1084

Hide starred & contributed projects of users with private profile

See merge request gitlab-org/security/gitlab!1082

Do not show emails of users in confirmation page

See merge request gitlab-org/security/gitlab!1080

Validate zoom links to start with https only

See merge request gitlab-org/security/gitlab!1078

Cleanup confidential epic todos

See merge request gitlab-org/security/gitlab!1092

Ensure group and project memberships are not leaked

See merge request gitlab-org/security/gitlab!1087

Fix mermaid resource consumption in GFM fields

See merge request gitlab-org/security/gitlab!1067

Filter params[:search] to prevent leaks

See merge request gitlab-org/security/gitlab!1070

Require a minimum search length on explore page

See merge request gitlab-org/security/gitlab!1101

GraphQL User: public_email instead of email

See merge request gitlab-org/security/gitlab!1073

Forbid Setting a gitlabUserList Strategy to a List From Another Project

See merge request gitlab-org/security/gitlab!1056

The regex now uses "Atomic Groups" to make sure there is no backtracking
and no performance issues on malicious package names

Since mermaid is an expensive operation, we defer the execution
when the browser is idle.

This page searches all public projects and the trigram index does not
work well with short search terms