Merge branch 'security-60039' into 'master'

Disallow invalid MR branch name

See merge request gitlab/gitlabhq!3052

1 files changed, 12 insertions, 0 deletions

diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index 311ba1ce6bd..81a8622bfe7 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -588,6 +588,8 @@ class MergeRequest < ApplicationRecord
       return
     end
 
+    [:source_branch, :target_branch].each { |attr| validate_branch_name(attr) }
+
     if opened?
       similar_mrs = target_project
         .merge_requests
@@ -608,6 +610,16 @@ class MergeRequest < ApplicationRecord
     end
   end
 
+  def validate_branch_name(attr)
+    return unless changes_include?(attr)
+
+    branch = read_attribute(attr)
+
+    return unless branch
+
+    errors.add(attr) unless Gitlab::GitRefValidator.validate_merge_request_branch(branch)
+  end
+
   def validate_target_project
     return true if target_project.merge_requests_enabled?