API for repository/commits returns 500 when ref_name is set to an empty string.

Summary

API for repository/commits returns 500 when ref_name is set to an empty string.

Steps to reproduce

Request

https://gitlab.com/api/v4/projects/SOME_ID/repository/commits?ref_name=&path=README.md' -H 'Sec-Fetch-Mode: cors'  -H 'Authorization: Bearer WXYZ' --compressed.

Response

{"message":"500 Internal Server Error"}

This should return the default branch, or a 403. Definitely not a 500.

What is the current bug behavior?

Returns 500

What is the expected correct behavior?

Return default branch or 403