ruby-grape / grape / 29200085335

97%

push

github

Don't mutate router maps at request time (#2790)

Grape::Router built @map and @optimized_map as auto-vivifying hashes
(Hash.new { |h, k| h[k] = ... }). compile! only fills keys for HTTP
methods that have routes, but at request time #match? and #rotation look
the maps up by the request's method, so any method with no routes inserted
a key into the shared hashes. The router is frozen only shallowly, so the
inner hashes stayed mutable.

That is a data race on runtimes without a GVL (JRuby, TruffleRuby), where
concurrent Hash#[]= corrupts the hash, and unbounded growth everywhere:
each distinct method string becomes a permanent key, so a client sending
arbitrary methods grows the maps without limit.

Use plain hashes, create the array explicitly on append, freeze both maps
after compile!, and read missing keys without inserting (#match? via safe
navigation, #rotation via &.each). Requests with an unrouted method still
resolve to 404/405 exactly as before.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

1130 of 1224 branches covered (92.32%)

Branch coverage included in aggregate %.

3591 of 3659 relevant lines covered (98.14%)

23189.09 hits per line