From 01a6adb2b453b852a9348365c4e867d6a36ddeb1 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Fri, 3 Dec 2021 10:02:12 +0000
Subject: Add latest changes from gitlab-org/security/gitlab@14-5-stable-ee

---
 app/services/protected_branches/base_service.rb   | 18 ++++++++++++++++++
 app/services/protected_branches/create_service.rb |  2 +-
 app/services/protected_branches/update_service.rb |  2 +-
 3 files changed, 20 insertions(+), 2 deletions(-)

(limited to 'app')

diff --git a/app/services/protected_branches/base_service.rb b/app/services/protected_branches/base_service.rb
index f48e02ab4b5..df801311aaf 100644
--- a/app/services/protected_branches/base_service.rb
+++ b/app/services/protected_branches/base_service.rb
@@ -13,5 +13,23 @@ module ProtectedBranches
     def after_execute(*)
       # overridden in EE::ProtectedBranches module
     end
+
+    def filtered_params
+      return unless params
+
+      params[:name] = sanitize_branch_name(params[:name]) if params[:name].present?
+      params
+    end
+
+    private
+
+    def sanitize_branch_name(name)
+      name = CGI.unescapeHTML(name)
+      name = Sanitize.fragment(name)
+
+      # Sanitize.fragment escapes HTML chars, so unescape again to allow names
+      # like `feature->master`
+      CGI.unescapeHTML(name)
+    end
   end
 end
diff --git a/app/services/protected_branches/create_service.rb b/app/services/protected_branches/create_service.rb
index dada449989a..ea494dd4426 100644
--- a/app/services/protected_branches/create_service.rb
+++ b/app/services/protected_branches/create_service.rb
@@ -21,7 +21,7 @@ module ProtectedBranches
     end
 
     def protected_branch
-      @protected_branch ||= project.protected_branches.new(params)
+      @protected_branch ||= project.protected_branches.new(filtered_params)
     end
   end
 end
diff --git a/app/services/protected_branches/update_service.rb b/app/services/protected_branches/update_service.rb
index 1e70f2d9793..40e9a286af9 100644
--- a/app/services/protected_branches/update_service.rb
+++ b/app/services/protected_branches/update_service.rb
@@ -8,7 +8,7 @@ module ProtectedBranches
       old_merge_access_levels = protected_branch.merge_access_levels.map(&:clone)
       old_push_access_levels = protected_branch.push_access_levels.map(&:clone)
 
-      if protected_branch.update(params)
+      if protected_branch.update(filtered_params)
         after_execute(protected_branch: protected_branch, old_merge_access_levels: old_merge_access_levels, old_push_access_levels: old_push_access_levels)
       end
 
-- 
cgit v1.2.1