gitlab-exporter 11.19.0 → 12.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 386af9238448d41f015fd10a4ae29d4e6b42913078cb0d86cbb862909bc2b7e0
-  data.tar.gz: 98e064fe309955646d3879528743528646b1bb57122a5237660b7be772cac359
+  metadata.gz: 10750ec2de43b0651c18fe3babdff54837e6e69b9efb921fd48bfda67d287bb6
+  data.tar.gz: bfcf564c0092a85b12f126772d06e5c04710088c6251252d69e2caf605cd1c9d
 SHA512:
-  metadata.gz: 415c5e84efdc17ebd72e7bc870fba4bb0f0052992390737c8d6cc64e397185f92f4deb3ffd6809700ea308719ad00061cafd44bd7c30f224144b4a5eec0926df
-  data.tar.gz: 740a3e32681f861ad5503b7605f2de60cef9a99d8fa64b2530c0aa5599462dce67fddbb1b4312fbd316881915d207d762e1d88215cbdf7f20d7cc7d20aa56897
+  metadata.gz: ab38e15c3fd76461f508921d1c960a0029b84afa673e30f7f95d57bd20d3c110232eff726723c3e7c69e154acd0b7d844fd10d960181d8de161e571423a4c151
+  data.tar.gz: 389adc0b2611a4e235b07ef72b92c77f2669db4092b624f0d5d0486fb18d894420090c172890625558cbc8f65b2a82c1906670bdf46a98a685667b757f2690d0

data/.ruby-version

@@ -1 +1 @@
-2.7.4
+2.7.6

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-exporter (11.19.0)
+    gitlab-exporter (12.0.1)
       connection_pool (= 2.2.5)
       faraday (~> 1.8.0)
       pg (= 1.2.3)

data/lib/gitlab_exporter/database/row_count.rb

@@ -125,9 +125,10 @@ module GitLab
               archived: {}
             }
           },
-          groups: {
+          namespaces: {
             select: :namespaces,
             fields: {
+              type: {},
               visibility_level: {},
               root: { definition: "(parent_id IS NULL)" }
             }
@@ -191,21 +192,21 @@ module GitLab
             select: :container_repositories,
             where: <<~SQL
               migration_state = 'pre_importing'
-              AND (COALESCE(migration_pre_import_started_at, '01-01-1970') < (now() - INTERVAL '20 minutes'))
+              AND (COALESCE(migration_pre_import_started_at, TO_TIMESTAMP(0)) < (now() - INTERVAL '20 minutes'))
             SQL
           },
           container_repositories_stalled_pre_import_done: {
             select: :container_repositories,
             where: <<~SQL
               migration_state = 'pre_import_done'
-              AND (COALESCE(migration_pre_import_done_at, '01-01-1970') < (now() - INTERVAL '5 minutes'))
+              AND (COALESCE(migration_pre_import_done_at, TO_TIMESTAMP(0)) < (now() - INTERVAL '5 minutes'))
             SQL
           },
           container_repositories_stalled_importing: {
             select: :container_repositories,
             where: <<~SQL
               migration_state = 'importing'
-              AND (COALESCE(migration_import_started_at, '01-01-1970') < (now() - INTERVAL '5 minutes'))
+              AND (COALESCE(migration_import_started_at, TO_TIMESTAMP(0)) < (now() - INTERVAL '5 minutes'))
             SQL
           },
           container_repositories_skipped_not_in_plan: {

data/lib/gitlab_exporter/rack_vulndb_255039_patch.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+if Gem.loaded_specs["rack"].version >= Gem::Version.new("3.0.0")
+  fail <<~ERR
+    This patch is unnecessary in Rack versions 3.0.0 or newer.
+    Please remove this file and the associated spec.
+
+    See https://github.com/rack/rack/blob/main/CHANGELOG.md#security (issue #1733)
+  ERR
+end
+
+# Patches a cache poisoning attack vector in Rack by not allowing semicolons
+# to delimit query parameters.
+# See https://github.com/rack/rack/issues/1732.
+#
+# Solution is taken from the same issue.
+#
+# The actual patch is due for release in Rack 3.0.0.
+module Rack
+  class Request # rubocop:disable Style/Documentation
+    Helpers.module_eval do
+      # rubocop: disable Naming/MethodName
+      def GET
+        if get_header(RACK_REQUEST_QUERY_STRING) == query_string
+          get_header(RACK_REQUEST_QUERY_HASH)
+        else
+          query_hash = parse_query(query_string, "&") # only allow ampersand here
+          set_header(RACK_REQUEST_QUERY_STRING, query_string)
+          set_header(RACK_REQUEST_QUERY_HASH, query_hash)
+        end
+      end
+      # rubocop: enable Naming/MethodName
+    end
+  end
+end

data/lib/gitlab_exporter/version.rb

@@ -1,5 +1,5 @@
 module GitLab
   module Exporter
-    VERSION = "11.19.0".freeze
+    VERSION = "12.0.1".freeze
   end
 end

data/lib/gitlab_exporter/web_exporter.rb

@@ -2,6 +2,7 @@ require "sinatra/base"
 require "English"
 require "cgi"
 
+require_relative "rack_vulndb_255039_patch"
 require_relative "tls_helper"
 
 module GitLab

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-exporter
 version: !ruby/object:Gem::Version
-  version: 11.19.0
+  version: 12.0.1
 platform: ruby
 authors:
 - Pablo Carranza
@@ -202,6 +202,7 @@ files:
 - lib/gitlab_exporter/prober.rb
 - lib/gitlab_exporter/process.rb
 - lib/gitlab_exporter/prometheus.rb
+- lib/gitlab_exporter/rack_vulndb_255039_patch.rb
 - lib/gitlab_exporter/ruby.rb
 - lib/gitlab_exporter/sidekiq.rb
 - lib/gitlab_exporter/tls_helper.rb