gregschmit / rails-rest-framework / 30382952146

95%

Build Type

push

github

Committed by gregschmit

Commit Message

Reject nested-hash filter params; document associations_limit_max.

Filter backends now guard against query params whose values are nested
hashes (e.g. `?field[evil]=x`, which Rack parses into a
HashWithIndifferentAccess). Previously these flowed into AR bind values
and raised `TypeError (can't quote ...)`, or broke `String#split` /
`sanitize_sql_like`. Adds a `_safe_query_value?` helper on BaseFilter,
applied in QueryFilter and OrderingFilter, and a String check in
SearchFilter. Includes regression tests for each backend.

Also documents `native_serializer_associations_limit_max` in the
serializers and performance guides: default `5` cap, clamp-to-max
semantics, and how to raise the ceiling or disable the query param.

Coverage Stats

7 of 7 new or added lines in 4 files covered. (100.0%)

42 existing lines in 4 files now uncovered.

1192 of 1296 relevant lines covered (91.98%)

316.5 hits per line