gitlab-exporter 11.17.1 → 11.18.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6ccef6882054ab76a7ae363221460936a3183ed9055b3b0df775373eac4865f
-  data.tar.gz: e940486956e6d8a32f6c10f696d7baebf27c16d7654e43446325a647e8281143
+  metadata.gz: 5bb85649c03d72472315136401ebb234618c2350a5e75e5f426619aed2c97286
+  data.tar.gz: f0f0f46b1cbfea992e7b171ed7a1877af7c232a5e0e1a549666d5086d8e72087
 SHA512:
-  metadata.gz: d9c4f7f435a0460cf5e068ee1d2840500ef12f3324e779aebcd04fe2cd42e98df18602851d25caedf0c49a91956fd7cb9a62a635eb6269a80d7fdf4b93e2010d
-  data.tar.gz: dc5e84fd8acd9568c924a5e51a753df3ad85b2efdea1b6e626fa8ed4e604fb5e05c040ec5700e3e85accf52734aa4cd34c37d3bd2549c35cb2e25808a337b04d
+  metadata.gz: ed4f5b1dfa84d713c4c2246fa3e77ca604fe49d616d11f0ddc6cf80d1a5d87bc79f62115e4abec9e7d18ef1f50b5f6a654a329d9477464c83f3884cbb06d960f
+  data.tar.gz: c10bb0f6452deff8a9f7615a8d7379d30e1c9cc428b50b8092f5f007db87b97ac12c6567b8db75f321a0c749686329931b6fa49ab2e1e63ae335b85341b5ee7b

data/.gitignore

@@ -1,2 +1,3 @@
 .bundle
+vendor
 config/gitlab-exporter*.yml

data/.gitlab-ci.yml

@@ -25,7 +25,8 @@ default:
 .before_scripts: &before_scripts
   - git config --global user.email "bot@gitlab.com"
   - git config --global user.name "Bot User"
-  - bundle install -j $(nproc) --path vendor
+  - bundle config set --local deployment true
+  - bundle install -j $(nproc)
 
 workflow:
   rules: &workflow_rules

data/Gemfile.lock

@@ -1,11 +1,11 @@
 PATH
   remote: .
   specs:
-    gitlab-exporter (11.17.1)
+    gitlab-exporter (11.18.2)
       connection_pool (= 2.2.5)
       faraday (~> 1.8.0)
       pg (= 1.2.3)
-      puma (= 5.6.2)
+      puma (= 5.6.5)
       quantile (= 0.2.1)
       redis (= 4.4.0)
       redis-namespace (= 1.6.0)
@@ -38,18 +38,18 @@ GEM
     faraday-patron (1.0.0)
     faraday-rack (1.0.0)
     multipart-post (2.2.3)
-    mustermann (1.1.1)
+    mustermann (2.0.2)
       ruby2_keywords (~> 0.0.1)
     nio4r (2.5.8)
     parallel (1.20.1)
     parser (3.0.0.0)
       ast (~> 2.4.1)
     pg (1.2.3)
-    puma (5.6.2)
+    puma (5.6.5)
       nio4r (~> 2.0)
     quantile (0.2.1)
     rack (2.2.4)
-    rack-protection (2.2.0)
+    rack-protection (2.2.2)
       rack
     rainbow (3.0.0)
     redis (4.4.0)
@@ -87,12 +87,12 @@ GEM
       connection_pool (>= 2.2.2)
       rack (~> 2.0)
       redis (>= 4.2.0)
-    sinatra (2.2.0)
-      mustermann (~> 1.0)
+    sinatra (2.2.2)
+      mustermann (~> 2.0)
       rack (~> 2.2)
-      rack-protection (= 2.2.0)
+      rack-protection (= 2.2.2)
       tilt (~> 2.0)
-    tilt (2.0.10)
+    tilt (2.0.11)
     unicode-display_width (1.7.0)
     webrick (1.7.0)
 

data/gitlab-exporter.gemspec

@@ -23,7 +23,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "connection_pool", "2.2.5"
   s.add_runtime_dependency "faraday", "~> 1.8.0"
   s.add_runtime_dependency "pg", "1.2.3"
-  s.add_runtime_dependency "puma", "5.6.2"
+  s.add_runtime_dependency "puma", "5.6.5"
   s.add_runtime_dependency "quantile", "0.2.1"
   s.add_runtime_dependency "redis", "4.4.0"
   s.add_runtime_dependency "redis-namespace", "1.6.0"

data/lib/gitlab_exporter/database/row_count.rb

@@ -136,7 +136,7 @@ module GitLab
             select: :container_repositories,
             where: <<~SQL
               migration_state <> 'import_done'
-              AND created_at < '2022-01-23 00:00:00'
+              AND created_at < '2022-08-17 00:00:00'
             SQL
           },
           container_repositories_pre_importing: {
@@ -174,7 +174,7 @@ module GitLab
             select: :container_repositories,
             where: <<~SQL
               migration_state <> 'import_done'
-              AND created_at < '2022-01-23 00:00:00'
+              AND created_at < '2022-08-17 00:00:00'
               AND (migration_plan IN ('free', 'early_adopter')
                 OR migration_plan IS NULL)
             SQL
@@ -182,7 +182,7 @@ module GitLab
           container_repositories_import_done_free: {
             select: :container_repositories,
             where: <<~SQL
-              (migration_state = 'import_done' OR created_at >= '2022-01-23 00:00:00')
+              (migration_state = 'import_done' OR created_at >= '2022-08-17 00:00:00')
               AND (migration_plan IN ('free', 'early_adopter')
                 OR migration_plan IS NULL)
             SQL

data/lib/gitlab_exporter/rack_vulndb_255039_patch.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+if Gem.loaded_specs["rack"].version >= Gem::Version.new("3.0.0")
+  fail <<~ERR
+    This patch is unnecessary in Rack versions 3.0.0 or newer.
+    Please remove this file and the associated spec.
+
+    See https://github.com/rack/rack/blob/main/CHANGELOG.md#security (issue #1733)
+  ERR
+end
+
+# Patches a cache poisoning attack vector in Rack by not allowing semicolons
+# to delimit query parameters.
+# See https://github.com/rack/rack/issues/1732.
+#
+# Solution is taken from the same issue.
+#
+# The actual patch is due for release in Rack 3.0.0.
+module Rack
+  class Request # rubocop:disable Style/Documentation
+    Helpers.module_eval do
+      # rubocop: disable Naming/MethodName
+      def GET
+        if get_header(RACK_REQUEST_QUERY_STRING) == query_string
+          get_header(RACK_REQUEST_QUERY_HASH)
+        else
+          query_hash = parse_query(query_string, "&") # only allow ampersand here
+          set_header(RACK_REQUEST_QUERY_STRING, query_string)
+          set_header(RACK_REQUEST_QUERY_HASH, query_hash)
+        end
+      end
+      # rubocop: enable Naming/MethodName
+    end
+  end
+end

data/lib/gitlab_exporter/version.rb

@@ -1,5 +1,5 @@
 module GitLab
   module Exporter
-    VERSION = "11.17.1".freeze
+    VERSION = "11.18.2".freeze
   end
 end

data/lib/gitlab_exporter/web_exporter.rb

@@ -2,6 +2,7 @@ require "sinatra/base"
 require "English"
 require "cgi"
 
+require_relative "rack_vulndb_255039_patch"
 require_relative "tls_helper"
 
 module GitLab

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-exporter
 version: !ruby/object:Gem::Version
-  version: 11.17.1
+  version: 11.18.2
 platform: ruby
 authors:
 - Pablo Carranza
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.2
+        version: 5.6.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.2
+        version: 5.6.5
 - !ruby/object:Gem::Dependency
   name: quantile
   requirement: !ruby/object:Gem::Requirement
@@ -202,6 +202,7 @@ files:
 - lib/gitlab_exporter/prober.rb
 - lib/gitlab_exporter/process.rb
 - lib/gitlab_exporter/prometheus.rb
+- lib/gitlab_exporter/rack_vulndb_255039_patch.rb
 - lib/gitlab_exporter/ruby.rb
 - lib/gitlab_exporter/sidekiq.rb
 - lib/gitlab_exporter/tls_helper.rb