screwdriver-api 8.0.181 → 8.0.183

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.181",
+  "version": "8.0.183",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/builds/artifacts/get.js

@@ -83,10 +83,18 @@ module.exports = config => ({
                             const directoryArray = manifestArray.filter(f => f.startsWith(`./${artifact}/`));
                             let totalSize = 0;
 
+                            // Manifest entries are build controlled, so encode them the same way
+                            // single file requests are encoded. Appending them verbatim lets
+                            // `..` segments be resolved away when the URL is normalized, which
+                            // would point the request at another build's artifacts.
+                            const fileUrl = file =>
+                                `${baseUrl}/${encodeURIComponent(file.replace(/^\.\//, ''))}`
+                                + `?token=${token}&type=download`;
+
                             // Check file sizes by fetching metadata
                             for (const file of directoryArray) {
                                 if (file) {
-                                    const fileMetaResponse = await request.head(`${baseUrl}/${file}?token=${token}&type=download`);
+                                    const fileMetaResponse = await request.head(fileUrl(file));
                                     const fileSize = parseInt(fileMetaResponse.headers['content-length'], 10);
 
                                     // Accumulate total size
@@ -120,7 +128,7 @@ module.exports = config => ({
                             // Fetch and append the directory files
                             for (const file of directoryArray) {
                                 if (file) {
-                                    const fileStream = request.stream(`${baseUrl}/${file}?token=${token}&type=download`);
+                                    const fileStream = request.stream(fileUrl(file));
 
                                     // Handle errors from file streaming
                                     fileStream.on('error', (err) => {

package/plugins/builds/artifacts/getAll.js

@@ -92,7 +92,12 @@ module.exports = config => ({
                     try {
                         for (const file of manifestArray) {
                             if (file) {
-                                const fileStream = request.stream(`${baseUrl}/${file}?token=${token}&type=download`);
+                                // Manifest entries are build controlled, so encode them before
+                                // appending. Verbatim entries let `..` segments be resolved away
+                                // when the URL is normalized, which would point the request at
+                                // another build's artifacts.
+                                const encodedFile = encodeURIComponent(file.replace(/^\.\//, ''));
+                                const fileStream = request.stream(`${baseUrl}/${encodedFile}?token=${token}&type=download`);
 
                                 fileStream.on('error', (err) => {
                                     logger.error(`Error downloading file: ${file}`, err);

package/plugins/builds/helper/updateBuild.js

@@ -6,7 +6,7 @@ const merge = require('lodash.mergewith');
 const isEmpty = require('lodash.isempty');
 const { PR_JOB_NAME, PR_STAGE_NAME, STAGE_TEARDOWN_PATTERN } = require('screwdriver-data-schema').config.regex;
 const { getFullStageJobName } = require('../../helper');
-const { locker } = require('../../lock');
+const locker = require('../../lock');
 const { updateVirtualBuildSuccess, emitBuildStatusEvent, isFixedBuild } = require('../triggers/helpers');
 const TERMINAL_STATUSES = ['FAILURE', 'ABORTED', 'UNSTABLE', 'COLLAPSED'];
 const FINISHED_STATUSES = ['SUCCESS', ...TERMINAL_STATUSES];
@@ -459,8 +459,16 @@ async function updateBuildAndTriggerDownstreamJobs(config, build, server, userna
     let stageBuild;
     const isStageTeardown = STAGE_TEARDOWN_PATTERN.test(job.name);
     let stageBuildHasFailure = false;
+    let stageLock;
+    let stageResource;
 
     if (stage) {
+        stageResource = `event:${event.id}:stage:${stage.id}`;
+        try {
+            stageLock = await locker.lock(stageResource);
+        } catch (err) {
+            stageLock = null;
+        }
         stageBuild = await stageBuildFactory.get({
             stageId: stage.id,
             eventId: newEvent.id
@@ -534,6 +542,13 @@ async function updateBuildAndTriggerDownstreamJobs(config, build, server, userna
             }
         }
     }
+    if (stageResource) {
+        try {
+            await locker.unlock(stageLock, stageResource);
+        } catch (err) {
+            // ignore unlock errors for parity with lock helper behavior
+        }
+    }
 
     // update event status
     const latestBuilds = await newEvent.getBuilds();