Elasticsearch leaks data through the notes scope

How it was found

Summary

The Elasticsearch results, when filtering using the notes scope, leaks data about private groups, private projects, and private issues.

Steps to reproduce

1. Search, as an anonymous user, nextbit in the Gitlab group, filtering for "comments" (link)
2. You will have as result a private note saying Riccardo Padovani mentioned in nextbit/virtualcore/gui#109 (see screenshot). This basically leaks information about the existence of a private group, a private subgroup, a private project, the ID of an issue in the project, and a membership of the project. 3. You can also retrieve more data through the APIs:

19:55:18 in ~ 
➜ curl "https://gitlab.com/api/v4/projects/278964/search?scope=notes&search=nextbit" --header "PRIVATE-TOKEN: TEST" | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   520  100   520    0     0    508      0  0:00:01  0:00:01 --:--:--   508
[
  {
    "id": 215547575,
    "type": null,
    "body": "mentioned in issue nextbit/VirtualCore/gui#109",
    "attachment": null,
    "author": {
      "id": 16048,
      "name": "Riccardo Padovani",
      "username": "rpadovani",
      "state": "active",
      "avatar_url": "https://secure.gravatar.com/avatar/9d89d4072afb4457b0c49131d8d258f5?s=80&d=identicon",
      "web_url": "https://gitlab.com/rpadovani"
    },
    "created_at": "2019-02-19T12:54:23.670Z",
    "updated_at": "2019-02-19T12:54:23.670Z",
    "system": true,
    "noteable_id": 24685040,
    "noteable_type": "Issue",
    "resolvable": false,
    "noteable_iid": 25362
  }
]

The token used is from another account, whom doesn't have access to nextbit, or doesn't have any relation with the mentioned issue. It is necessary 'cause search APIs can be used only by logged users.

The ID of the project where we perform the search is the Gitlab one.

Impact

Elasticsearch doesn't properly authorize access to the notes in search results, so there are leaks of private data, given the right search query.

Output of checks

This bug happens on GitLab.com

Impact

Elasticsearch doesn't properly authorize access to the notes in search results, so there are leaks of private data, given the right search query