Skip to content

Fix generation of ETag when sending Git blobs

Heinrich Lee Yu requested to merge 280553-cache-raw-endpoint into master

What does this MR do?

The #stale? check in this method was always returning true because we were manually setting the ETag and this was being compared to an ETag that was generated differently. Rails generates the ETag based on the passed blob.id combined with other default etaggers https://github.com/rails/rails/blob/f432f70aeb64d5a1bd397ce8a306ad211ef7da5e/actionpack/lib/action_controller/metal/conditional_get.rb#L284-L286.

Now that we return a 304 here, we no longer set the Content-Disposition and Gitlab-Workhorse-Send-Data headers and Workhorse just passes this through to the client. So this MR also reverts https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/215 so that we can cache the raw endpoint again.

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #280553 (closed)

Edited by Nick Thomas

Merge request reports

Loading