[merge-train skip]

[ci skip]

Use tag helper for javascript tag in redirect

See merge request gitlab-org/security/gitlab!1458

This will automatically include the nonce for CSP

Bump BinData version

See merge request gitlab-org/security/gitlab!1403

Changelog: security

Updates authorization for lint

See merge request gitlab-org/security/gitlab!1430

Adds redirect page to OAuth

See merge request gitlab-org/security/gitlab!1442

Block access to gitlab for users with expired password

See merge request gitlab-org/security/gitlab!1445

Limit rotations when removing members to those accessible to the member

See merge request gitlab-org/security/gitlab!1388

OAuth implicit grant access tokens are not logged

See merge request gitlab-org/security/gitlab!1436

Use xpath instead of css for searching in banzai [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1415

Truncate all non-blob markdown to 1MB by default

See merge request gitlab-org/security/gitlab!1419

Merge branch 'security-dblessing_update_users_two_factor_required_from_group-13-11' into '13-11-stable-ee'

Update users two factor required from group

See merge request gitlab-org/security/gitlab!1433

Opt in to Atlassians new context qsh

See merge request gitlab-org/security/gitlab!1405

Merge branch 'security-297665-validate-commit-author-for-x509-signatures-13-11-ee' into '13-11-stable-ee'

Only verify commit signatures if the user email is verified

See merge request gitlab-org/security/gitlab!1386

Prevent XSS on notebooks

See merge request gitlab-org/security/gitlab!1422

Cherry-pick !62553 into 13-11-stable-ee

See merge request gitlab-org/gitlab!62561

Changelog: security

The goal is to make sure the user to go through js-based redirect

Changelog: security

Remove db changelog requirement from danger

See merge request gitlab-org/gitlab!62509

John Skarbek authored 3 years ago and Mayra Cabrera committed 3 years ago

Backports changes from https://gitlab.com/gitlab-org/gitlab/-/merge_requests/62493
into 13-11-stable-ee branch

Changelog: security

Fix rubocop offence

Add specs for new method

Fix typo in spec title

Drew Blessing authored 3 years ago and Drew Blessing committed 3 years ago

A background migration to ensure users have the correct setting
when two factor is required by a group they're a member of. A
prior bug caused this setting to be incorrect. That bug is fixed
going forward and this is a one-time fix for existing cases.

Changelog: security

* Force some form of authentication in order to access the lint
endpoint for unauthenticated users on GitLab instances with restrictions
* Adds a method for determining if registration on an instance is
limited based on the above
* Adds specs for all the cases mentioned above

Changelog: security

Atlassian introduces a [change to their JWTs for Connect apps][0].

There are two types of JWT, the one being affected (Context JWT) is not
utilized by us. Therefore we do not need to do any code changes in the
auth logic. This change only opts in to the new security model they are
rolling out on June 7th.

For more details see: https://gitlab.com/gitlab-org/gitlab/-/issues/328267

[0]: https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072

Changelog: security

Currently, users are able to create "verified" commit signatures for
emails they don't control.

Changelog: security

Prevented the use of data attributes for notebooks.

Changelog: security

For large node trees, xpath is significantly faster and uses
less memory

Changelog: security

and prepend a user message if the limit is over a
certain threshold

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Prepare 13.11.4-ee release

See merge request gitlab-org/gitlab!61736

Stan Hu authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Omit trailing slash when checking allowed requests in the read-only middleware [RUN ALL RSPEC]

See merge request gitlab-org/gitlab!61641

(cherry picked from commit 205ac619)

128f7287 Omit trailing slash when checking allowed requests
94c80317 Add CHANGELOG entry

Nick Thomas authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Omit trailing slash when proxying pre-authorized routes with no suffix

See merge request gitlab-org/gitlab!61638

(cherry picked from commit fe7e3723)

79fc9f2b Omit trailing slash when proxying pre-authorized routes with no suffix

Robert Speicher authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Fix N+1 SQL queries in  PipelinesController#show

See merge request gitlab-org/gitlab!60794

(cherry picked from commit ced23566)

035856f8 Fix N+1 SQL queries in PipelinesController#show