Validate MR branch names

Prevents refspec as branch name, which would bypass branch protection
when used in conjunction with rebase.

HEAD seems to be a special case with lots of occurrence,
so it is considered valid for now.

Another special case is `refs/head/*`, which can be imported.

1 files changed, 65 insertions, 27 deletions

diff --git a/spec/lib/gitlab/git_ref_validator_spec.rb b/spec/lib/gitlab/git_ref_validator_spec.rb
index 3ab04a1c46d..6fc41cd64f9 100644
--- a/spec/lib/gitlab/git_ref_validator_spec.rb
+++ b/spec/lib/gitlab/git_ref_validator_spec.rb
@@ -1,31 +1,69 @@
 require 'spec_helper'
 
 describe Gitlab::GitRefValidator do
-  it { expect(described_class.validate('feature/new')).to be_truthy }
-  it { expect(described_class.validate('implement_@all')).to be_truthy }
-  it { expect(described_class.validate('my_new_feature')).to be_truthy }
-  it { expect(described_class.validate('my-branch')).to be_truthy }
-  it { expect(described_class.validate('#1')).to be_truthy }
-  it { expect(described_class.validate('feature/refs/heads/foo')).to be_truthy }
-  it { expect(described_class.validate('feature/~new/')).to be_falsey }
-  it { expect(described_class.validate('feature/^new/')).to be_falsey }
-  it { expect(described_class.validate('feature/:new/')).to be_falsey }
-  it { expect(described_class.validate('feature/?new/')).to be_falsey }
-  it { expect(described_class.validate('feature/*new/')).to be_falsey }
-  it { expect(described_class.validate('feature/[new/')).to be_falsey }
-  it { expect(described_class.validate('feature/new/')).to be_falsey }
-  it { expect(described_class.validate('feature/new.')).to be_falsey }
-  it { expect(described_class.validate('feature\@{')).to be_falsey }
-  it { expect(described_class.validate('feature\new')).to be_falsey }
-  it { expect(described_class.validate('feature//new')).to be_falsey }
-  it { expect(described_class.validate('feature new')).to be_falsey }
-  it { expect(described_class.validate('refs/heads/')).to be_falsey }
-  it { expect(described_class.validate('refs/remotes/')).to be_falsey }
-  it { expect(described_class.validate('refs/heads/feature')).to be_falsey }
-  it { expect(described_class.validate('refs/remotes/origin')).to be_falsey }
-  it { expect(described_class.validate('-')).to be_falsey }
-  it { expect(described_class.validate('-branch')).to be_falsey }
-  it { expect(described_class.validate('.tag')).to be_falsey }
-  it { expect(described_class.validate('my branch')).to be_falsey }
-  it { expect(described_class.validate("\xA0\u0000\xB0")).to be_falsey }
+  using RSpec::Parameterized::TableSyntax
+
+  context '.validate' do
+    it { expect(described_class.validate('feature/new')).to be_truthy }
+    it { expect(described_class.validate('implement_@all')).to be_truthy }
+    it { expect(described_class.validate('my_new_feature')).to be_truthy }
+    it { expect(described_class.validate('my-branch')).to be_truthy }
+    it { expect(described_class.validate('#1')).to be_truthy }
+    it { expect(described_class.validate('feature/refs/heads/foo')).to be_truthy }
+    it { expect(described_class.validate('feature/~new/')).to be_falsey }
+    it { expect(described_class.validate('feature/^new/')).to be_falsey }
+    it { expect(described_class.validate('feature/:new/')).to be_falsey }
+    it { expect(described_class.validate('feature/?new/')).to be_falsey }
+    it { expect(described_class.validate('feature/*new/')).to be_falsey }
+    it { expect(described_class.validate('feature/[new/')).to be_falsey }
+    it { expect(described_class.validate('feature/new/')).to be_falsey }
+    it { expect(described_class.validate('feature/new.')).to be_falsey }
+    it { expect(described_class.validate('feature\@{')).to be_falsey }
+    it { expect(described_class.validate('feature\new')).to be_falsey }
+    it { expect(described_class.validate('feature//new')).to be_falsey }
+    it { expect(described_class.validate('feature new')).to be_falsey }
+    it { expect(described_class.validate('refs/heads/')).to be_falsey }
+    it { expect(described_class.validate('refs/remotes/')).to be_falsey }
+    it { expect(described_class.validate('refs/heads/feature')).to be_falsey }
+    it { expect(described_class.validate('refs/remotes/origin')).to be_falsey }
+    it { expect(described_class.validate('-')).to be_falsey }
+    it { expect(described_class.validate('-branch')).to be_falsey }
+    it { expect(described_class.validate('+foo:bar')).to be_falsey }
+    it { expect(described_class.validate('foo:bar')).to be_falsey }
+    it { expect(described_class.validate('.tag')).to be_falsey }
+    it { expect(described_class.validate('my branch')).to be_falsey }
+    it { expect(described_class.validate("\xA0\u0000\xB0")).to be_falsey }
+  end
+
+  context '.validate_merge_request_branch' do
+    it { expect(described_class.validate_merge_request_branch('HEAD')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('feature/new')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('implement_@all')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('my_new_feature')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('my-branch')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('#1')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('feature/refs/heads/foo')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('feature/~new/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature/^new/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature/:new/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature/?new/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature/*new/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature/[new/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature/new/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature/new.')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature\@{')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature\new')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature//new')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('feature new')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('refs/heads/master')).to be_truthy }
+    it { expect(described_class.validate_merge_request_branch('refs/heads/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('refs/remotes/')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('-')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('-branch')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('+foo:bar')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('foo:bar')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('.tag')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch('my branch')).to be_falsey }
+    it { expect(described_class.validate_merge_request_branch("\xA0\u0000\xB0")).to be_falsey }
+  end
 end