From 22d7c1379fea684dc09e9347e134741fb6b5b2c6 Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Sun, 7 Oct 2018 23:16:45 -0700 Subject: Reject invalid branch names in repository compare controller Closes #51003 --- .../projects/compare_controller_spec.rb | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'spec/controllers/projects/compare_controller_spec.rb') diff --git a/spec/controllers/projects/compare_controller_spec.rb b/spec/controllers/projects/compare_controller_spec.rb index 8695aa826bb..17883d0fadd 100644 --- a/spec/controllers/projects/compare_controller_spec.rb +++ b/spec/controllers/projects/compare_controller_spec.rb @@ -97,6 +97,30 @@ describe Projects::CompareController do expect(assigns(:commits)).to eq([]) end end + + context 'when the target ref is invalid' do + let(:target_ref) { "master%' AND 2554=4423 AND '%'='" } + let(:source_ref) { "improve%2Fawesome" } + + it 'shows a flash message and redirects' do + show_request + + expect(flash[:alert]).to eq('Invalid branch name') + expect(response).to have_http_status(302) + end + end + + context 'when the source ref is invalid' do + let(:source_ref) { "master%' AND 2554=4423 AND '%'='" } + let(:target_ref) { "improve%2Fawesome" } + + it 'shows a flash message and redirects' do + show_request + + expect(flash[:alert]).to eq('Invalid branch name') + expect(response).to have_http_status(302) + end + end end describe 'GET diff_for_path' do -- cgit v1.2.1