Merge branch 'rs-trailing-slash-in-search' into 'master'

Escape the query argument provided to `git grep` by `search_files`

Closes #14963.

See merge request !3633

2 files changed, 7 insertions, 1 deletions

diff --git a/app/models/repository.rb b/app/models/repository.rb
index 0b2289cfa39..89062170481 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -797,7 +797,7 @@ class Repository
 
   def search_files(query, ref)
     offset = 2
-    args = %W(#{Gitlab.config.git.bin_path} grep -i -I -n --before-context #{offset} --after-context #{offset} -e #{query} #{ref || root_ref})
+    args = %W(#{Gitlab.config.git.bin_path} grep -i -I -n --before-context #{offset} --after-context #{offset} -e #{Regexp.escape(query)} #{ref || root_ref})
     Gitlab::Popen.popen(args, path_to_repo).first.scrub.split(/^--$/)
   end
 
diff --git a/spec/models/repository_spec.rb b/spec/models/repository_spec.rb
index c3a4016fa49..86f68b3a0a0 100644
--- a/spec/models/repository_spec.rb
+++ b/spec/models/repository_spec.rb
@@ -94,6 +94,12 @@ describe Repository, models: true do
 
     it { is_expected.to be_an Array }
 
+    it 'regex-escapes the query string' do
+      results = repository.search_files("test\\", 'master')
+
+      expect(results.first).not_to start_with('fatal:')
+    end
+
     describe 'result' do
       subject { results.first }