ruby-grape / grape / 35441678826

99%

master: 100%

Pull #2957

github

Reject an element that is not a Hash in an Array param given a block

The block of `requires :items, type: Array do ... end` declares the keys of
each element, but nothing checked that an element had keys at all. One
that was not a Hash only failed where the block required a key of it --
`items[0][key] is missing` -- so a block of optional params let a String, a
number or a nested Array straight through to the endpoint:

    optional :lines, type: Array do
      optional :sku, type: String
      optional :qty, type: Integer
    end
    # {"lines":["x", 5, [{"sku":"a"}]]}  => passes; lines.sum { _1[:qty] } raises

#2838 stopped the iterator unwrapping an Array nested deeper than the
declaration, and relied on those required keys to fail it. Where the
nested scope's params are optional there are none, so
`{"orders":[[{"lines":5}]]}` against an Array scope nested in another now
passed validation -- 3.3.5 had answered 400 -- and `declared` then raised
NoMethodError calling `any?` on the 5.

ParamsScope now registers a HashElementsValidator for every `type: Array`
param given a block, which answers `items[1] is invalid` for the first
element that is neither a Hash nor blank. Blank elements are still passed
over, as the block's own validators pass over an optional scope whose
elements are all blank. `Array[JSON]` already checks its elements when it
parses them.

`declared` also stops raising on a value that is neither a Hash nor an
Array where nested params are declared, and returns it as it came in, as
#2935 made it do for such an element. Validation no longer lets one reach
it through an Array, but a `given` whose dependency is not met still leaves
its params unvalidated, and `{"address":"somewhere"}` against a Hash scope
inside one raised the same NoMethodError on 3.3.5 and since.

UPGRADING covers the stricter validation and the element error that now
leads a required key's.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

1437 of 1493 branches covered (96.25%)

Branch coverage included in aggregate %.

14 of 14 new or added lines in 3 files covered. (100.0%)

4286 of 4286 relevant lines covered (100.0%)

28637.21 hits per line