From 99c3448c4102eab0ccf80829ecbeb96225dc8a53 Mon Sep 17 00:00:00 2001
From: Pravin Barton <9560941+isc-pbarton@users.noreply.github.com>
Date: Tue, 14 Apr 2026 11:52:17 -0400
Subject: [PATCH 1/3] fix: display of branch names with special characters

---
 CHANGELOG.md                                            | 1 +
 git-webui/release/share/git-webui/webui/js/git-webui.js | 8 ++++----
 git-webui/src/share/git-webui/webui/js/git-webui.js     | 8 ++++----
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4d1020b..58538049 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Changes to % routines mapped to the current namespace may now be added to source control and committed (#944)
 - Edits to a decomposed production in VS Code fixed after changes to the VS Code ObjectScript extension (#949)
+- Branch names containing special characters (e.g. `#`) now display correctly in the Git Web UI (#914)
 
 ## [2.16.0] - 2026-03-06
 
diff --git a/git-webui/release/share/git-webui/webui/js/git-webui.js b/git-webui/release/share/git-webui/webui/js/git-webui.js
index fe51b83a..1de2b488 100644
--- a/git-webui/release/share/git-webui/webui/js/git-webui.js
+++ b/git-webui/release/share/git-webui/webui/js/git-webui.js
@@ -439,7 +439,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             searchBar.onkeyup = function(){ 
                 let branchCards = accordionDiv.getElementsByClassName("branch-card");
 
-                var filter = searchBar.value.toUpperCase().replaceAll('/', '-');
+                var filter = searchBar.value.toUpperCase().replaceAll('/', '-').replaceAll('#', '_');
 
                 for (let i = 0; i < branchCards.length; i++) {
                     let card = branchCards[i]
@@ -469,7 +469,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             var cardDiv = $('<div class="card custom-card branch-card">').appendTo(accordionDiv)[0];
             if (id.indexOf("local-branches") > -1) {
                 // parses the output of git branch --verbose --verbose
-                var matches = /^\*?\s*([\w-.@&_\/]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
+                var matches = /^\*?\s*([\w-.@&_\/\#]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
                 if (!matches) {
                     continue;
                 }
@@ -480,7 +480,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
                 var refname = branchInfo.branch_name;
                 var canPush = (branchInfo.remote === undefined) || (branchInfo.remote.indexOf("ahead") > -1) // either no upstream or ahead of upstream
-                var itemId = refname.replaceAll('/', '-') + idPostfix;
+                var itemId = refname.replaceAll('/', '-').replaceAll('#', '_') + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId + '">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                                 + refname
@@ -508,7 +508,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
             } else {
                 var refname = ref.replaceAll('/', '-');
-                var itemId = refname + idPostfix;
+                var itemId = refname.replaceAll('#', '_') + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId +'">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                             + ref //IMPORTANT: This has to be the original ref for selectRef to work 
diff --git a/git-webui/src/share/git-webui/webui/js/git-webui.js b/git-webui/src/share/git-webui/webui/js/git-webui.js
index fe51b83a..1de2b488 100644
--- a/git-webui/src/share/git-webui/webui/js/git-webui.js
+++ b/git-webui/src/share/git-webui/webui/js/git-webui.js
@@ -439,7 +439,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             searchBar.onkeyup = function(){ 
                 let branchCards = accordionDiv.getElementsByClassName("branch-card");
 
-                var filter = searchBar.value.toUpperCase().replaceAll('/', '-');
+                var filter = searchBar.value.toUpperCase().replaceAll('/', '-').replaceAll('#', '_');
 
                 for (let i = 0; i < branchCards.length; i++) {
                     let card = branchCards[i]
@@ -469,7 +469,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             var cardDiv = $('<div class="card custom-card branch-card">').appendTo(accordionDiv)[0];
             if (id.indexOf("local-branches") > -1) {
                 // parses the output of git branch --verbose --verbose
-                var matches = /^\*?\s*([\w-.@&_\/]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
+                var matches = /^\*?\s*([\w-.@&_\/\#]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
                 if (!matches) {
                     continue;
                 }
@@ -480,7 +480,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
                 var refname = branchInfo.branch_name;
                 var canPush = (branchInfo.remote === undefined) || (branchInfo.remote.indexOf("ahead") > -1) // either no upstream or ahead of upstream
-                var itemId = refname.replaceAll('/', '-') + idPostfix;
+                var itemId = refname.replaceAll('/', '-').replaceAll('#', '_') + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId + '">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                                 + refname
@@ -508,7 +508,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
             } else {
                 var refname = ref.replaceAll('/', '-');
-                var itemId = refname + idPostfix;
+                var itemId = refname.replaceAll('#', '_') + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId +'">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                             + ref //IMPORTANT: This has to be the original ref for selectRef to work 

From 6645dcbf0b4fb3f978de19390aa55562f58cb3ba Mon Sep 17 00:00:00 2001
From: Pravin Barton <9560941+isc-pbarton@users.noreply.github.com>
Date: Thu, 16 Apr 2026 13:45:41 -0400
Subject: [PATCH 2/3] fix: constrain branch names, add validation and warnings
 to invalid branch names

---
 CHANGELOG.md                                  |  2 +-
 cls/SourceControl/Git/Utils.cls               | 10 +++++
 .../share/git-webui/webui/js/git-webui.js     | 38 ++++++++++++++++---
 .../src/share/git-webui/webui/js/git-webui.js | 38 ++++++++++++++++---
 4 files changed, 75 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58538049..fe4685c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,7 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Changes to % routines mapped to the current namespace may now be added to source control and committed (#944)
 - Edits to a decomposed production in VS Code fixed after changes to the VS Code ObjectScript extension (#949)
-- Branch names containing special characters (e.g. `#`) now display correctly in the Git Web UI (#914)
+- Branch names are now constrained to a reasonable set of allowed characters, fixing an issue where branch names with special characters were hidden without explanation (#914)
 
 ## [2.16.0] - 2026-03-06
 
diff --git a/cls/SourceControl/Git/Utils.cls b/cls/SourceControl/Git/Utils.cls
index 7330ca09..7e9d7868 100644
--- a/cls/SourceControl/Git/Utils.cls
+++ b/cls/SourceControl/Git/Utils.cls
@@ -457,12 +457,22 @@ ClassMethod TakeOwnership(InternalName As %String) As %Status
     quit sc
 }
 
+/// Validates that a branch name contains only supported characters.
+/// Supported: letters (a-z, A-Z), digits (0-9), hyphens (-), underscores (_), periods (.), and forward slashes (/).
+ClassMethod IsValidBranchName(branchName As %String) As %Boolean
+{
+    quit $match(branchName, "[a-zA-Z0-9._/-]+")
+}
+
 /// <p>This function performs <code>git checkout -b [newBranchName]</code> from the current commit.</p>
 /// <p>If the user is in "Basic Mode" AND there is a Default Merge Branch defined,
 /// then this method first checks out and pulls that default merge branch before creating the new branch. This is
 /// equivalent to <code>git checkout [defaultMergeBranch] && git pull</code>.</p>
 ClassMethod NewBranch(newBranchName As %String) As %Status
 {
+    if '..IsValidBranchName(newBranchName) {
+        quit $$$ERROR($$$GeneralError, "Invalid branch name. Branch names may only contain letters, numbers, hyphens, underscores, periods, and forward slashes.")
+    }
     set settings = ##class(SourceControl.Git.Settings).%New()
     if (settings.basicMode) && (settings.defaultMergeBranch '= ""){
         set err = ..RunGitWithArgs(.errStream, .outStream, "checkout", settings.defaultMergeBranch)
diff --git a/git-webui/release/share/git-webui/webui/js/git-webui.js b/git-webui/release/share/git-webui/webui/js/git-webui.js
index 1de2b488..e8fe52e8 100644
--- a/git-webui/release/share/git-webui/webui/js/git-webui.js
+++ b/git-webui/release/share/git-webui/webui/js/git-webui.js
@@ -439,7 +439,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             searchBar.onkeyup = function(){ 
                 let branchCards = accordionDiv.getElementsByClassName("branch-card");
 
-                var filter = searchBar.value.toUpperCase().replaceAll('/', '-').replaceAll('#', '_');
+                var filter = searchBar.value.toUpperCase().replaceAll('/', '-');
 
                 for (let i = 0; i < branchCards.length; i++) {
                     let card = branchCards[i]
@@ -455,6 +455,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             };
         }
 
+        var skippedCount = 0;
         for (var i = 0; i < refs.length && i < maxRefsCount; ++i) {
             var ref = refs[i] + ""; // Get a copy of it
             if (ref[2] == '(' && ref[ref.length - 1] == ')') {
@@ -469,8 +470,11 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             var cardDiv = $('<div class="card custom-card branch-card">').appendTo(accordionDiv)[0];
             if (id.indexOf("local-branches") > -1) {
                 // parses the output of git branch --verbose --verbose
-                var matches = /^\*?\s*([\w-.@&_\/\#]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
+                // only match branch names with supported characters (letters, numbers, . - _ /)
+                var matches = /^\*?\s*([a-zA-Z0-9._\/-]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
                 if (!matches) {
+                    $(cardDiv).remove();
+                    skippedCount++;
                     continue;
                 }
                 var branchInfo = {
@@ -480,7 +484,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
                 var refname = branchInfo.branch_name;
                 var canPush = (branchInfo.remote === undefined) || (branchInfo.remote.indexOf("ahead") > -1) // either no upstream or ahead of upstream
-                var itemId = refname.replaceAll('/', '-').replaceAll('#', '_') + idPostfix;
+                var itemId = refname.replaceAll('/', '-') + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId + '">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                                 + refname
@@ -507,8 +511,14 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                     }
                 }
             } else {
+                // filter remote branches with unsupported characters
+                if (!/^[a-zA-Z0-9._\/-]+$/.test(ref)) {
+                    $(cardDiv).remove();
+                    skippedCount++;
+                    continue;
+                }
                 var refname = ref.replaceAll('/', '-');
-                var itemId = refname.replaceAll('#', '_') + idPostfix;
+                var itemId = refname + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId +'">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                             + ref //IMPORTANT: This has to be the original ref for selectRef to work 
@@ -527,6 +537,14 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             });
         }
 
+        if (skippedCount > 0) {
+            var warningMsg = skippedCount + " branch" + (skippedCount > 1 ? "es" : "") +
+                " with unsupported characters hidden. Branch names may only contain letters, numbers, hyphens, underscores, periods, and forward slashes.";
+            $('<div class="alert alert-warning mt-2 p-2" style="font-size: 0.8em;" role="alert">' +
+                warningMsg +
+            '</div>').appendTo(accordionDiv);
+        }
+
         if (id === "remote-branches" && idPostfix === "popup") {
             var remoteBranchBtns = $("#accordion-remote-branches-popup button").filter(function (i, span) {
                 return jQuery.inArray($(span).text(), refs) != -1;
@@ -562,9 +580,17 @@ webui.SideBarView = function(mainView, noEventHandlers) {
         }
     
         $("#btn_createList").click(function(e)
-        {   
+        {
             var refName = $('#newBranchName').val()
-    
+
+            // Validate branch name: only allow characters matching GitHub defaults
+            // Allowed: a-z, A-Z, 0-9, period, hyphen, underscore, forward slash
+            var branchNamePattern = /^[a-zA-Z0-9._\/-]+$/;
+            if (!branchNamePattern.test(refName)) {
+                alert("Invalid branch name. Branch names may only contain letters, numbers, hyphens, underscores, periods, and forward slashes.");
+                return;
+            }
+
             var flag = 0;
             webui.git("status -u --porcelain", function(data) {
                 $.get("api/uncommitted", function (uncommitted) {
diff --git a/git-webui/src/share/git-webui/webui/js/git-webui.js b/git-webui/src/share/git-webui/webui/js/git-webui.js
index 1de2b488..e8fe52e8 100644
--- a/git-webui/src/share/git-webui/webui/js/git-webui.js
+++ b/git-webui/src/share/git-webui/webui/js/git-webui.js
@@ -439,7 +439,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             searchBar.onkeyup = function(){ 
                 let branchCards = accordionDiv.getElementsByClassName("branch-card");
 
-                var filter = searchBar.value.toUpperCase().replaceAll('/', '-').replaceAll('#', '_');
+                var filter = searchBar.value.toUpperCase().replaceAll('/', '-');
 
                 for (let i = 0; i < branchCards.length; i++) {
                     let card = branchCards[i]
@@ -455,6 +455,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             };
         }
 
+        var skippedCount = 0;
         for (var i = 0; i < refs.length && i < maxRefsCount; ++i) {
             var ref = refs[i] + ""; // Get a copy of it
             if (ref[2] == '(' && ref[ref.length - 1] == ')') {
@@ -469,8 +470,11 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             var cardDiv = $('<div class="card custom-card branch-card">').appendTo(accordionDiv)[0];
             if (id.indexOf("local-branches") > -1) {
                 // parses the output of git branch --verbose --verbose
-                var matches = /^\*?\s*([\w-.@&_\/\#]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
+                // only match branch names with supported characters (letters, numbers, . - _ /)
+                var matches = /^\*?\s*([a-zA-Z0-9._\/-]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
                 if (!matches) {
+                    $(cardDiv).remove();
+                    skippedCount++;
                     continue;
                 }
                 var branchInfo = {
@@ -480,7 +484,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
                 var refname = branchInfo.branch_name;
                 var canPush = (branchInfo.remote === undefined) || (branchInfo.remote.indexOf("ahead") > -1) // either no upstream or ahead of upstream
-                var itemId = refname.replaceAll('/', '-').replaceAll('#', '_') + idPostfix;
+                var itemId = refname.replaceAll('/', '-') + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId + '">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                                 + refname
@@ -507,8 +511,14 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                     }
                 }
             } else {
+                // filter remote branches with unsupported characters
+                if (!/^[a-zA-Z0-9._\/-]+$/.test(ref)) {
+                    $(cardDiv).remove();
+                    skippedCount++;
+                    continue;
+                }
                 var refname = ref.replaceAll('/', '-');
-                var itemId = refname.replaceAll('#', '_') + idPostfix;
+                var itemId = refname + idPostfix;
                 var cardHeader = $('<div class="card-header" id="heading-' + itemId +'">').appendTo(cardDiv);
                 var button = $('<button class="btn btn-sm btn-default btn-branch text-left" type="button" data-toggle="collapse" data-target="#collapse-' + itemId + '" aria-expanded="true" aria-controls="collapse-' + itemId + '">'
                             + ref //IMPORTANT: This has to be the original ref for selectRef to work 
@@ -527,6 +537,14 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             });
         }
 
+        if (skippedCount > 0) {
+            var warningMsg = skippedCount + " branch" + (skippedCount > 1 ? "es" : "") +
+                " with unsupported characters hidden. Branch names may only contain letters, numbers, hyphens, underscores, periods, and forward slashes.";
+            $('<div class="alert alert-warning mt-2 p-2" style="font-size: 0.8em;" role="alert">' +
+                warningMsg +
+            '</div>').appendTo(accordionDiv);
+        }
+
         if (id === "remote-branches" && idPostfix === "popup") {
             var remoteBranchBtns = $("#accordion-remote-branches-popup button").filter(function (i, span) {
                 return jQuery.inArray($(span).text(), refs) != -1;
@@ -562,9 +580,17 @@ webui.SideBarView = function(mainView, noEventHandlers) {
         }
     
         $("#btn_createList").click(function(e)
-        {   
+        {
             var refName = $('#newBranchName').val()
-    
+
+            // Validate branch name: only allow characters matching GitHub defaults
+            // Allowed: a-z, A-Z, 0-9, period, hyphen, underscore, forward slash
+            var branchNamePattern = /^[a-zA-Z0-9._\/-]+$/;
+            if (!branchNamePattern.test(refName)) {
+                alert("Invalid branch name. Branch names may only contain letters, numbers, hyphens, underscores, periods, and forward slashes.");
+                return;
+            }
+
             var flag = 0;
             webui.git("status -u --porcelain", function(data) {
                 $.get("api/uncommitted", function (uncommitted) {

From ef73200ea079bb90acfc715cc466e37d2d936d28 Mon Sep 17 00:00:00 2001
From: Pravin Barton <9560941+isc-pbarton@users.noreply.github.com>
Date: Fri, 1 May 2026 12:11:14 -0400
Subject: [PATCH 3/3] refactor: less duplication on valid branch name regex;
 unit test for back end branch validation

---
 .../share/git-webui/webui/js/git-webui.js        | 16 +++++++++-------
 .../src/share/git-webui/webui/js/git-webui.js    | 16 +++++++++-------
 .../SourceControl/Git/Utils/NewBranch.cls        | 11 +++++++++++
 3 files changed, 29 insertions(+), 14 deletions(-)
 create mode 100644 test/UnitTest/SourceControl/Git/Utils/NewBranch.cls

diff --git a/git-webui/release/share/git-webui/webui/js/git-webui.js b/git-webui/release/share/git-webui/webui/js/git-webui.js
index e8fe52e8..a4f7c83d 100644
--- a/git-webui/release/share/git-webui/webui/js/git-webui.js
+++ b/git-webui/release/share/git-webui/webui/js/git-webui.js
@@ -85,6 +85,9 @@ webui.pageInfo = {
     isFileHistory: false
 };
 
+/// Regex for supported branch names: letters, numbers, . - _ /
+webui.branchNamePattern = /^[a-zA-Z0-9._\/-]+$/;
+
 webui.quotePath = function(path) {
     return '"' + path.replace(/"/g, '\\"') + '"';
 }
@@ -470,8 +473,9 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             var cardDiv = $('<div class="card custom-card branch-card">').appendTo(accordionDiv)[0];
             if (id.indexOf("local-branches") > -1) {
                 // parses the output of git branch --verbose --verbose
-                // only match branch names with supported characters (letters, numbers, . - _ /)
-                var matches = /^\*?\s*([a-zA-Z0-9._\/-]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
+                // only match branch names with supported characters (see webui.branchNamePattern)
+                var reMatchGitBranchOutput = new RegExp("^\*?\s*("+ webui.branchNamePattern.source +")\s+([^\s]+)\s+(\[.*\])?.*")
+                var matches = reMatchGitBranchOutput.exec(ref);
                 if (!matches) {
                     $(cardDiv).remove();
                     skippedCount++;
@@ -512,7 +516,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
             } else {
                 // filter remote branches with unsupported characters
-                if (!/^[a-zA-Z0-9._\/-]+$/.test(ref)) {
+                if (!webui.branchNamePattern.test(ref)) {
                     $(cardDiv).remove();
                     skippedCount++;
                     continue;
@@ -583,10 +587,8 @@ webui.SideBarView = function(mainView, noEventHandlers) {
         {
             var refName = $('#newBranchName').val()
 
-            // Validate branch name: only allow characters matching GitHub defaults
-            // Allowed: a-z, A-Z, 0-9, period, hyphen, underscore, forward slash
-            var branchNamePattern = /^[a-zA-Z0-9._\/-]+$/;
-            if (!branchNamePattern.test(refName)) {
+            // Validate branch name: only allow a subset of characters.
+            if (!webui.branchNamePattern.test(refName)) {
                 alert("Invalid branch name. Branch names may only contain letters, numbers, hyphens, underscores, periods, and forward slashes.");
                 return;
             }
diff --git a/git-webui/src/share/git-webui/webui/js/git-webui.js b/git-webui/src/share/git-webui/webui/js/git-webui.js
index e8fe52e8..a4f7c83d 100644
--- a/git-webui/src/share/git-webui/webui/js/git-webui.js
+++ b/git-webui/src/share/git-webui/webui/js/git-webui.js
@@ -85,6 +85,9 @@ webui.pageInfo = {
     isFileHistory: false
 };
 
+/// Regex for supported branch names: letters, numbers, . - _ /
+webui.branchNamePattern = /^[a-zA-Z0-9._\/-]+$/;
+
 webui.quotePath = function(path) {
     return '"' + path.replace(/"/g, '\\"') + '"';
 }
@@ -470,8 +473,9 @@ webui.SideBarView = function(mainView, noEventHandlers) {
             var cardDiv = $('<div class="card custom-card branch-card">').appendTo(accordionDiv)[0];
             if (id.indexOf("local-branches") > -1) {
                 // parses the output of git branch --verbose --verbose
-                // only match branch names with supported characters (letters, numbers, . - _ /)
-                var matches = /^\*?\s*([a-zA-Z0-9._\/-]+)\s+([^\s]+)\s+(\[.*\])?.*/.exec(ref);
+                // only match branch names with supported characters (see webui.branchNamePattern)
+                var reMatchGitBranchOutput = new RegExp("^\*?\s*("+ webui.branchNamePattern.source +")\s+([^\s]+)\s+(\[.*\])?.*")
+                var matches = reMatchGitBranchOutput.exec(ref);
                 if (!matches) {
                     $(cardDiv).remove();
                     skippedCount++;
@@ -512,7 +516,7 @@ webui.SideBarView = function(mainView, noEventHandlers) {
                 }
             } else {
                 // filter remote branches with unsupported characters
-                if (!/^[a-zA-Z0-9._\/-]+$/.test(ref)) {
+                if (!webui.branchNamePattern.test(ref)) {
                     $(cardDiv).remove();
                     skippedCount++;
                     continue;
@@ -583,10 +587,8 @@ webui.SideBarView = function(mainView, noEventHandlers) {
         {
             var refName = $('#newBranchName').val()
 
-            // Validate branch name: only allow characters matching GitHub defaults
-            // Allowed: a-z, A-Z, 0-9, period, hyphen, underscore, forward slash
-            var branchNamePattern = /^[a-zA-Z0-9._\/-]+$/;
-            if (!branchNamePattern.test(refName)) {
+            // Validate branch name: only allow a subset of characters.
+            if (!webui.branchNamePattern.test(refName)) {
                 alert("Invalid branch name. Branch names may only contain letters, numbers, hyphens, underscores, periods, and forward slashes.");
                 return;
             }
diff --git a/test/UnitTest/SourceControl/Git/Utils/NewBranch.cls b/test/UnitTest/SourceControl/Git/Utils/NewBranch.cls
new file mode 100644
index 00000000..6216076d
--- /dev/null
+++ b/test/UnitTest/SourceControl/Git/Utils/NewBranch.cls
@@ -0,0 +1,11 @@
+Class UnitTest.SourceControl.Git.Utils.NewBranch Extends UnitTest.SourceControl.Git.AbstractTest
+{
+
+Method TestCreateSupportedBranchNames()
+{
+    $$$ThrowOnError(##class(SourceControl.Git.Utils).Init())
+    do $$$AssertStatusNotOK(##class(SourceControl.Git.Utils).NewBranch("not a good#branch name"))
+    do $$$AssertStatusOK(##class(SourceControl.Git.Utils).NewBranch("a-good/branch-name.2"))
+}
+
+}