[go: up one dir, main page]

Merge request draft notes API does not perform necessary validation

Summary

Creating a draft note on an otherwise "uncommentable" file (too large or a no-change rename) via REST API returns a success and saves the note server-side.

An API call to publish the new note also succeeds, but the note just silently disappears.

Steps to reproduce

  1. Create a merge request containing a file change, that is too large according to set limits
  2. Call the REST API endpoint to create a new draft note
  3. Observe that the draft note was created and is returned by the draft notes REST API query
  4. Publish the note with REST API call to either a single note publisher or bulk publisher
  5. Observe that the note is no longer returned by neither draft notes list API, nor any other note APIs

Example Project

Example of the merge request with a large file (huge_lorem.txt) and a renamed file (README_RENAMED.MD): iasemenov/mr-test!1

What is the current bug behavior?

Every call succeeds while being incorrect

What is the expected correct behavior?

The call to create a draft note on an "uncommentable" file must return a 40* HTTP code error and a proper error message

Output of checks

This bug happens on GitLab.com

Edited by 🤖 GitLab Bot 🤖