fix: do not show private pipeline from another scm user (#194)

screwdriver-cd · Nov 13, 2021 · 5bb8bc4 · 5bb8bc4
1 parent d753c1c
commit 5bb8bc4
Show file tree

Hide file tree

Showing 2 changed files with 79 additions and 1 deletion.
diff --git a/index.js b/index.js
@@ -227,6 +227,11 @@ class GithubScm extends Scm {
             privateRepo = scmRepo.privateRepo || false;
         } else {
             try {
+                if (scmHost !== this.config.gheHost) {
+                    throw new Error(
+                        `Pipeline's scmHost ${scmHost} does not match with user's scmHost ${this.config.gheHost}`
+                    );
+                }
                 // https://github.com/octokit/rest.js/issues/163
                 const repo = await this.breaker.runCommand({
                     scopeType: 'request',

diff --git a/test/index.test.js b/test/index.test.js
@@ -115,7 +115,8 @@ describe('index', function() {
             oauthClientId: 'abcdefg',
             oauthClientSecret: 'hijklmno',
             secret: 'somesecret',
-            commentUserToken: 'sometoken'
+            commentUserToken: 'sometoken',
+            gheHost: 'github.com'
         });
     });
 
@@ -723,6 +724,33 @@ describe('index', function() {
                     }
                 );
         });
+
+        it('rejects when scm settings is mismatch', () => {
+            const scmUriNotMatch = 'notmatching.com:23498:targetBranch';
+            const [scmHost] = scmUriNotMatch.split(':');
+            const loginContext = scm.getScmContexts();
+            const loginHost = loginContext[0].split(':')[1];
+
+            const testError = new Error(
+                `Pipeline's scmHost ${scmHost} does not match with user's scmHost ${loginHost}`
+            );
+
+            githubMock.request.rejects(testError);
+
+            return scm
+                .lookupScmUri({
+                    scmUri: scmUriNotMatch,
+                    token: 'sometoken'
+                })
+                .then(
+                    () => {
+                        assert.fail('This should not fail the test');
+                    },
+                    error => {
+                        assert.strictEqual(error.message, testError.message);
+                    }
+                );
+        });
     });
 
     describe('updateCommitStatus', () => {
@@ -1859,6 +1887,20 @@ jobs:
                 }
             });
 
+            scm = new GithubScm({
+                fusebox: {
+                    retry: {
+                        minTimeout: 1
+                    }
+                },
+                readOnly: {},
+                oauthClientId: 'abcdefg',
+                oauthClientSecret: 'hijklmno',
+                secret: 'somesecret',
+                commentUserToken: 'sometoken',
+                gheHost: 'internal-ghe.mycompany.com'
+            });
+
             return scm
                 .decorateCommit({
                     scmUri,
@@ -1907,6 +1949,20 @@ jobs:
             });
             githubMock.users.getByUsername.resolves();
 
+            scm = new GithubScm({
+                fusebox: {
+                    retry: {
+                        minTimeout: 1
+                    }
+                },
+                readOnly: {},
+                oauthClientId: 'abcdefg',
+                oauthClientSecret: 'hijklmno',
+                secret: 'somesecret',
+                commentUserToken: 'sometoken',
+                gheHost: 'internal-ghe.mycompany.com'
+            });
+
             return scm
                 .decorateCommit({
                     scmUri,
@@ -1946,6 +2002,20 @@ jobs:
 
             githubMock.repos.getCommit.rejects(testError);
 
+            scm = new GithubScm({
+                fusebox: {
+                    retry: {
+                        minTimeout: 1
+                    }
+                },
+                readOnly: {},
+                oauthClientId: 'abcdefg',
+                oauthClientSecret: 'hijklmno',
+                secret: 'somesecret',
+                commentUserToken: 'sometoken',
+                gheHost: 'internal-ghe.mycompany.com'
+            });
+
             return scm
                 .decorateCommit({
                     scmUri,
@@ -2119,6 +2189,9 @@ jobs:
                     'github:github.com': {
                         clientId: 'abcdefg',
                         clientSecret: 'hijklmno',
+                        config: {
+                            uri: 'https://github.com'
+                        },
                         forceHttps: false,
                         isSecure: false,
                         provider: 'github',