Add latest changes from gitlab-org/gitlab@14-9-stable-eev14.9.0-rc42

1 files changed, 9 insertions, 0 deletions

diff --git a/app/graphql/resolvers/blobs_resolver.rb b/app/graphql/resolvers/blobs_resolver.rb
index d0eb2deaf48..0704a845bb0 100644
--- a/app/graphql/resolvers/blobs_resolver.rb
+++ b/app/graphql/resolvers/blobs_resolver.rb
@@ -30,8 +30,17 @@ module Resolvers
       return [] if repository.empty?
 
       ref ||= repository.root_ref
+      validate_ref(ref)
 
       repository.blobs_at(paths.map { |path| [ref, path] })
     end
+
+    private
+
+    def validate_ref(ref)
+      unless Gitlab::GitRefValidator.validate(ref)
+        raise Gitlab::Graphql::Errors::ArgumentError, 'Ref is not valid'
+      end
+    end
   end
 end