ruby-grape / grape / 30215793031

97%

push

github

Guard length, same_as and oneof against non-hash params (#2816)

These were the only three validators reading params[attr_name] without
the hash_like? guard the other seven have. When an Array-typed scope
receives non-hash elements (GET ?list[]=str), the iterator yields each
element as the params container, String#[](Symbol) raises TypeError,
and run_validators only rescues validation exceptions — so a malformed
request produced a 500. Skipping like ValuesValidator does lets the
presence/coerce validators report the 400.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

1167 of 1258 branches covered (92.77%)

Branch coverage included in aggregate %.

3790 of 3857 relevant lines covered (98.26%)

24793.65 hits per line