diff --git a/app/models/integration.rb b/app/models/integration.rb index a5b5e238410db54c75daed7370603ac3078f23dd..e64fff2d811143a0c5296d04fc96541c539d8ce4 100644 --- a/app/models/integration.rb +++ b/app/models/integration.rb @@ -414,7 +414,10 @@ def event_field(event) end def api_field_names - fields.pluck(:name).grep_v(/password|token|key|title|description/) + fields + .reject { _1[:type] == 'password' } + .pluck(:name) + .grep_v(/password|token|key/) end def global_fields diff --git a/lib/api/entities/project_integration.rb b/lib/api/entities/project_integration.rb index 649e4d015b8c4a7e7bd9324578f667338bbdbef7..155136d2f80addbf5cdc9e49a395b74a8d4ce5ab 100644 --- a/lib/api/entities/project_integration.rb +++ b/lib/api/entities/project_integration.rb @@ -5,19 +5,8 @@ module Entities class ProjectIntegration < Entities::ProjectIntegrationBasic # Expose serialized properties expose :properties do |integration, options| - # TODO: Simplify as part of https://gitlab.com/gitlab-org/gitlab/issues/29404 - - attributes = - if integration.data_fields_present? - integration.data_fields.as_json.keys - else - integration.properties.keys - end - - attributes &= integration.api_field_names - - attributes.each_with_object({}) do |attribute, hash| - hash[attribute] = integration.public_send(attribute) # rubocop:disable GitlabSecurity/PublicSend + integration.api_field_names.to_h do |name| + [name, integration.public_send(name)] # rubocop:disable GitlabSecurity/PublicSend end end end diff --git a/spec/models/integration_spec.rb b/spec/models/integration_spec.rb index b8f75e8595e3044e87156d1a858354aa46d22c2d..c0bb0ba636d9dc06f85cf8dbf8d7e55543ee44c6 100644 --- a/spec/models/integration_spec.rb +++ b/spec/models/integration_spec.rb @@ -732,14 +732,21 @@ def fields { name: 'password' }, { name: 'password_field' }, { name: 'some_safe_field' }, - { name: 'safe_field' } + { name: 'safe_field' }, + { name: 'url' }, + { name: 'trojan_horse', type: 'password' }, + { name: 'trojan_gift', type: 'gift' } ].shuffle end end end it 'filters out sensitive fields' do - expect(fake_integration.new).to have_attributes(api_field_names: match_array(%w[some_safe_field safe_field])) + safe_fields = %w[some_safe_field safe_field url trojan_gift] + + expect(fake_integration.new).to have_attributes( + api_field_names: match_array(safe_fields) + ) end end