[10.3] Fix XSS vulnerability in Pipeline job trace

See merge request gitlab/gitlabhq!2258

(cherry picked from commit 44caa80ed9a2514a74a5eeab10ff51849d64851b)

5f86f3ff Fix XSS vulnerability in Pipeline job trace

Grzegorz Bizon authored 7 years ago and Shinya Maeda committed 7 years ago

Fix environment scope regex

See merge request gitlab-org/gitlab-ee!3641

We should allow to use double underscore in the path, and it seems that
our container repository path regexp was outdated.

See https://github.com/docker/distribution/blob/master/reference/regexp.go

https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/2112

This reverts commit b0498c17

This regexp is extracted from Docker Distribution 2.4.1 docs, contains
additional `/` element that can be a separator of components.

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Javascript does not support the negative lookbehind assertion (?<!) used
in the Ruby regex (to disallow usernames ending in `.git` or `.atom`.

Getting the client side code to fully support this format is
non-trivial, since we'd either have to heavily complicate the
regex used, or modify the frontend code to support more complex
validation schemes (it currently uses HTML5 validations).

The pragmatic choice is to create a
`Gitlab::Regex::NAMESPACE_REGEX_STR_SIMPLE` regex to serve as a
Javascript-compatible version of `NAMESPACE_REGEX_STR`.

The client-side code will not display an error for usernames ending in
`.git` and `.atom`, but these will be caught by the server-side
validation.

Added ability to put emojis into repository name

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Adds .git and .atom to the master namespace regex
Updates existing group tests and adds two new ones
Updates path cleaning to also forbid .atom

Squashed commits:
[f9a9315] Use : to test invalid environment name

Environments that can have a URL with predefined CI variables.

This reverts commit 13e37a3e.