500 Internal Server Error: Create a commit with invalid parameter "branch"

Summary

500 Internal Server Error when creating a commit with invalid parameter "branch".

API Endpotin: POST /projects/{id}/repository/commits

Steps to reproduce

1、Create a new project
2、Create a commit for the new project with special characters ":" in the branch parameter:

URL :localhost/api/v4/projects/35605735/repository/commits

header: {'Content-Type': 'application/json',
          'Authorization': 'Bearer token'}

data:{"branch": "email:1@gmail.com",
        "commit_message": "suaxpicd7f",
        "actions": [{"action": "create",
                     "file_path": "8apwey0w5h", "execute_filemode": "False"}]}

Example Project

The bug is reproducible on "gitlab.com" and on our local deployment of enterprise edition (14.4.2-ee).

What is the current bug behavior?

HTTP Response: "500 Internal Server Error."

What is the expected correct behavior?

HTTP Response: "400 Bad Request: {"error":"branch is invalid"}"

Relevant logs and/or screenshots

==> /var/log/gitlab/gitlab-rails/production.log <==
Started POST "/api/v4/projects/3160/repository/commits" for 10.230.41.181 at 2022-04-24 15:50:46 +0000

==> /var/log/gitlab/gitlab-rails/exceptions_json.log <==
{"severity":"ERROR","time":"2022-04-24T15:50:46.436Z","correlation_id":"01G1E49BAK8ZBG20CZHDDTZ5FX","exception.class":"GRPC::InvalidArgument","exception.message":"3:TreeEntry: revision can't contain ':'. debug_error_string:{\"created\":\"@1650815446.421622693\",\"description\":\"Error received from peer unix:/var/opt/gitlab/gitaly/gitaly.socket\",\"file\":\"src/core/lib/surface/call.cc\",\"file_line\":1055,\"grpc_message\":\"TreeEntry: revision can't contain ':'\",\"grpc_status\":3}","exception.backtrace":[],"user.username":"root","tags.program":"web","tags.locale":"en","tags.feature_category":"source_code_management","tags.correlation_id":"01G1E49BAK8ZBG20CZHDDTZ5FX"}

==> /var/log/gitlab/gitlab-rails/production.log <==

GRPC::InvalidArgument (3:TreeEntry: revision can't contain ':'. debug_error_string:{"created":"@1650815446.421622693","description":"Error received from peer unix:/var/opt/gitlab/gitaly/gitaly.socket","file":"src/core/lib/surface/call.cc","file_line":1055,"grpc_message":"TreeEntry: revision can't contain ':'","grpc_status":3}):
  /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.30.2-x86_64-linux/src/ruby/lib/grpc/generic/active_call.rb:29:in `check_status'
  /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.30.2-x86_64-linux/src/ruby/lib/grpc/generic/active_call.rb:180:in `attach_status_results_and_complete_call'
  /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.30.2-x86_64-linux/src/ruby/lib/grpc/generic/active_call.rb:169:in `receive_and_check_status'
  /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.30.2-x86_64-linux/src/ruby/lib/grpc/generic/active_call.rb:337:in `each_remote_read_then_finish'
  puma: cluster worker 5: 561 [gitlab-puma-worker]:in `each'

==> /var/log/gitlab/gitlab-rails/api_json.log <==
{"time":"2022-04-24T15:50:46.438Z","severity":"INFO","duration_s":0.06865,"db_duration_s":0.00861,"view_duration_s":0.06004,"status":500,"method":"POST","path":"/api/v4/projects/3160/repository/commits","params":[{"key":"branch","value":"email:1@gmail.com"},{"key":"commit_message","value":"suaxpicd7f"},{"key":"actions","value":[{"action":"create","file_path":"8apwey0w5h","execute_filemode":"False"}]}],"host":"10.176.40.198","remote_ip":"10.230.41.181, 127.0.0.1","ua":"PostmanRuntime/7.29.0","route":"/api/:version/projects/:id/repository/commits","user_id":1,"username":"root","exception.class":"GRPC::InvalidArgument","exception.message":"3:TreeEntry: revision can't contain ':'. debug_error_string:{\"created\":\"@1650815446.421622693\",\"description\":\"Error received from peer unix:/var/opt/gitlab/gitaly/gitaly.socket\",\"file\":\"src/core/lib/surface/call.cc\",\"file_line\":1055,\"grpc_message\":\"TreeEntry: revision can't contain ':'\",\"grpc_status\":3}","exception.backtrace":[],"queue_duration_s":0.012638,"gitaly_calls":2,"gitaly_duration_s":0.007501,"redis_calls":6,"redis_duration_s":0.004542,"redis_read_bytes":109,"redis_write_bytes":289,"redis_cache_calls":2,"redis_cache_duration_s":0.000375,"redis_cache_read_bytes":109,"redis_cache_write_bytes":87,"redis_shared_state_calls":4,"redis_shared_state_duration_s":0.004167,"redis_shared_state_write_bytes":202,"db_count":18,"db_write_count":0,"db_cached_count":7,"db_replica_count":0,"db_replica_cached_count":0,"db_replica_wal_count":0,"db_replica_wal_cached_count":0,"db_primary_count":18,"db_primary_cached_count":7,"db_primary_wal_count":0,"db_primary_wal_cached_count":0,"db_replica_duration_s":0.0,"db_primary_duration_s":0.009,"cpu_s":0.065598,"mem_objects":17041,"mem_bytes":1870264,"mem_mallocs":7058,"mem_total_bytes":2551904,"pid":655581,"correlation_id":"01G1E49BAK8ZBG20CZHDDTZ5FX","meta.user":"root","meta.project":"root/abc","meta.root_namespace":"root","meta.caller_id":"POST /api/:version/projects/:id/repository/commits","meta.remote_ip":"10.230.41.181","meta.feature_category":"source_code_management","meta.client_id":"user/1","content_length":"194"}

Output of checks

Checking GitLab subtasks ...

Checking GitLab Shell ...

GitLab Shell: ... GitLab Shell version >= 13.21.1 ? ... OK (13.21.1)
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Internal API available: OK
Redis available via internal API: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Gitaly ...

Gitaly: ... default ... OK

Checking Gitaly ... Finished

Checking Sidekiq ...

Sidekiq: ... Running? ... yes
Number of Sidekiq processes (cluster/worker) ... 1/1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished

Checking GitLab App ...

Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet)
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ... 
Administrator / a ... yes
Redis version >= 5.0.0? ... yes
Ruby version >= 2.7.2 ? ... yes (2.7.4)
Git version >= 2.33.0 ? ... yes (2.33.0)
Git user has default SSH configuration? ... yes
Active users: ... 1
Is authorized keys file accessible? ... yes
GitLab configured to store new projects in hashed storage? ... yes
All projects are in hashed storage? ... yes
Elasticsearch version 7.x (6.4 - 6.x deprecated to be removed in 13.8)? ... skipped (elasticsearch is disabled)

Checking GitLab App ... Finished


Checking GitLab subtasks ... Finished

comments

This bug was found using REST API fuzzing.