1 files changed, 12 insertions, 0 deletions
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index df162e4844c..f5431d2b3d6 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -586,6 +586,8 @@ class MergeRequest < ApplicationRecord
       return
     end
 
+    [:source_branch, :target_branch].each { |attr| validate_branch_name(attr) }
+
     if opened?
       similar_mrs = target_project
         .merge_requests
@@ -606,6 +608,16 @@ class MergeRequest < ApplicationRecord
     end
   end
 
+  def validate_branch_name(attr)
+    return unless changes_include?(attr)
+
+    branch = read_attribute(attr)
+
+    return unless branch
+
+    errors.add(attr) unless Gitlab::GitRefValidator.validate_merge_request_branch(branch)
+  end
+
   def validate_target_project
     return true if target_project.merge_requests_enabled?