Method FetchBranchDiff

coderd/externalauth/gitprovider/gitlab.go:297–422

(
	ctx context.Context,
	token string,
	ref BranchRef,
)

}

func (g *gitlabProvider) FetchBranchDiff(
	ctx context.Context,
	token string,
	ref BranchRef,
) (string, error) {
	if ref.Owner == "" || ref.Repo == "" || ref.Branch == "" {
		return "", nil
	}

	pid := gitLabPID(ref.Owner, ref.Repo)
	opts := reqOpts(ctx, token)

	// Get the default branch from the project.
	project, _, err := g.client.Projects.GetProject(pid, nil, opts...)
	if err != nil {
		return "", g.wrapError(err, "get project")
	}
	defaultBranch := strings.TrimSpace(project.DefaultBranch)
	if defaultBranch == "" {
		return "", xerrors.New("gitlab project default branch is empty")
	}

	// Use raw HTTP with io.LimitReader to bound memory. The library's
	// Compare() decodes the full response before returning, which
	// would allow a maliciously large diff to OOM the process.
	compareURL := fmt.Sprintf("%sprojects/%s/repository/compare?from=%s&to=%s&unidiff=true",
		g.client.BaseURL().String(),
		url.PathEscape(pid),
		url.QueryEscape(defaultBranch),
		url.QueryEscape(ref.Branch),
	)
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, compareURL, nil)
	if err != nil {
		return "", g.wrapError(err, "create compare request")
	}
	if token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
	}

	resp, err := g.client.HTTPClient().Do(req)
	if err != nil {
		return "", g.wrapError(err, "compare branches")
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		if rlErr := checkRateLimitError(resp, g.clock, "RateLimit-Reset"); rlErr != nil {
			return "", rlErr
		}
		body, readErr := io.ReadAll(io.LimitReader(resp.Body, 8192))
		if readErr != nil {
			return "", g.wrapError(
				xerrors.Errorf("unexpected status %d", resp.StatusCode),
				"compare branches",
			)
		}
		return "", g.wrapError(
			xerrors.Errorf("unexpected status %d: %s", resp.StatusCode, strings.TrimSpace(string(body))),