Skip to content

[500] New branch form does not validate inputs and raises 500.

Created by: cirosantilli

Go to :project_id/branches/new.

Fill in with either an invalid:

  • Git branch name like one containing a space: a b
  • inexistent base branch like adsfqwerasdfqwer

Outcome: 500, the branch is simply not created, nil is returned, then something does nil.attribute and raises.

Expected outcome: controller validates, and shows the form again.

What GitHub does with spaces: automatically replaces them with hyphens. For other errors like pathname containing slashes it says: "Sorry, that branch name is invalid."

What is a valid new reference is described at: https://www.kernel.org/pub/software/scm/git/docs/git-check-ref-format.html and can be checked automatically with git check-ref-format. I don't think we should take a subset of it as that would still allow users to push such branches from the command line: let's just call git check-ref-format itself.

The same will happen when https://github.com/gitlabhq/gitlabhq/pull/7266 is done, which is why I found this in the first place.

Another validation problem: if the new branch name is already taken, the following happens: http://feedback.gitlab.com/forums/176466-general/suggestions/6201425-validate-branch-name-uniqueness-on-web-ui-creation . That should also be validated.