ruby-grape / grape / 30170997140

97%

master: 97%

push

github

Add fuzz test for adversarial nesting depth

Several validation-runtime paths recurse on the shape of incoming params:
AttributesIterator#do_each recurses into nested arrays, and coercion/oneof
walk nested hashes and arrays. A deeply nested payload is a resource-
exhaustion surface.

This fuzzes random shapes (nested arrays, hashes, mixed) and depths across
every recursive path — Array/Hash scopes, type: JSON, oneof, Set coercion —
sending real request bytes, and asserts the request is never answered with a
5xx / uncaught exception. It documents that the upstream parsers
(Rack param_depth_limit, JSON max_nesting) cap depth well below Grape's own
recursion ceiling, so the reachable surface degrades to a controlled 4xx.

The generator is seeded from RSpec's seed, so a failure reproduces with
--seed <n> and prints the offending endpoint/shape/depth.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1140 of 1230 branches covered (92.68%)

Branch coverage included in aggregate %.

3749 of 3816 relevant lines covered (98.24%)

25555.21 hits per line