ruby-grape / grape / 30490183440

97%

master: 97%

Pull #2838

github

Reject params nested deeper than the array scope declares

`AttributesIterator#do_each` recursed into any element that was an Array.
That recursion is required when the declaration itself nests array scopes —
`map_params` adds one level of nesting per Array-typed scope on the chain, so
the params for the inner scope really are an array of arrays — but nothing
compared the incoming depth against the declared one.

A request could therefore wrap its elements in extra arrays and have them
silently unwrapped:

    params do
      requires :lines, type: Array do
        requires :book_id, type: String
        requires :qty, type: Integer
      end
    end

`{"lines":[[{"book_id":"x","qty":1}]]}` passed validation, and `params[:lines]`
/ `declared` then handed the endpoint `[[{...}]]`. Any ordinary body assuming
the declared shape (`params[:lines].sum { |l| l[:qty] }`) died with a
`TypeError`, i.e. a 500 on malformed input. `[[]]` passed the same way.

Each scope now records, at definition time, how many Array-typed scopes sit on
its chain; the iterator descends that many levels less the one `Array.wrap`
already consumes, and yields anything deeper as-is. The attribute validators
then see a non-hash and fail it exactly as they do for any other unexpected
element type, so these requests get the 400 they always should have.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1199 of 1289 branches covered (93.02%)

Branch coverage included in aggregate %.

3811 of 3878 relevant lines covered (98.27%)

26975.37 hits per line