Block empty params to MR target branch autocompletion

app/controllers/autocomplete_controller.rb

@@ -53,7 +53,7 @@ class AutocompleteController < ApplicationController
   private
 
   def target_branch_params
-    params.permit(:group_id, :project_id)
+    params.permit(:group_id, :project_id).select { |_, v| v.present? }
   end
 end
 

spec/controllers/autocomplete_controller_spec.rb

@@ -391,15 +391,26 @@ describe AutocompleteController do
     end
 
     context 'user with an accessible merge request but no scope' do
+      where(
+        params: [
+          {},
+          { group_id: ' ' },
+          { project_id: ' ' },
+          { group_id: ' ', project_id: ' ' }
+        ]
+      )
+
+      with_them do
         it 'returns an error' do
           sign_in(user)
 
-        get :merge_request_target_branches
+          get :merge_request_target_branches, params: params
 
           expect(response).to have_gitlab_http_status(400)
           expect(json_response).to eq({ 'error' => 'At least one of group_id or project_id must be specified' })
         end
       end
+    end
 
     context 'user with an accessible merge request by project' do
       it 'returns json' do