Merge dev.gitlab.org master into GitLab.com master

1 files changed, 12 insertions, 0 deletions

diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index 2602738901b..ab914e84650 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -589,6 +589,8 @@ class MergeRequest < ApplicationRecord
       return
     end
 
+    [:source_branch, :target_branch].each { |attr| validate_branch_name(attr) }
+
     if opened?
       similar_mrs = target_project
         .merge_requests
@@ -609,6 +611,16 @@ class MergeRequest < ApplicationRecord
     end
   end
 
+  def validate_branch_name(attr)
+    return unless changes_include?(attr)
+
+    branch = read_attribute(attr)
+
+    return unless branch
+
+    errors.add(attr) unless Gitlab::GitRefValidator.validate_merge_request_branch(branch)
+  end
+
   def validate_target_project
     return true if target_project.merge_requests_enabled?