Skip to content

Guard against empty filenames for job artifacts

Sam Figueroa requested to merge sf/bugfix/artifact-download-audit-480694 into master

What does this MR do and why?

Guard against empty filenames for job artifacts

  • In some cases the file might not exist. def present_carrierwave_file! guards for this with a not_found! In those cases we can skip the audit of the attempted download since the user will receive a 404.

  • Refs: #480694

  • Fixes: #438129

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

  1. Trigger a job that produces artifacts
  2. Attempt to download the artifact in the UI or via API curl --location --header "PRIVATE-TOKEN: XXXXXXX" "https://localhost:3000/api/v4/projects/<PROJID>/jobs/artifacts/<ARTIFACT>/download
  3. Should not return 500
  4. View audits
Edited by Sam Figueroa

Merge request reports