ruby-grape / grape / 35989475641

100%

master: 100%

Pull #3006

github

Answer params and versions holding invalid bytes instead of raising

ActiveSupport's String#blank? matches a whitespace regexp, and a regexp
raises ArgumentError on a UTF-8 String holding bytes the encoding does
not allow -- which is what Rack decodes `%FF` in a query string into.
Request-time checks asked it of an unscrubbed value, so any client
could turn these into a 500:

- `given :a` with `?a=%FF`
- an optional Hash scope with `?a=%FF`, at the root or inside a `given`
- an optional Array scope with `?a[]=%FF`
- `version using: :param` with `?apiver=%FF`
- `version using: :header` with an Accept header holding invalid UTF-8
  (a server handing headers over as binary was not affected)

ParamsScope now asks a private `blank_param?`, which keeps `blank?`'s
answer -- `given` is documented to use it, so `false` and whitespace
still count as absent -- except that a String holding an invalid byte
is never blank: the byte is not whitespace. #2954 applied the same rule
to a DELETE body. The Param versioner scrubs the value, as
AcceptVersionHeader already does, and the Header versioner scrubs the
header before anything reads it: `downcase`, `split` and Rack's q-value
parsing raise on such bytes too. Its precomputed table is still read
with the header as it came, so a hit costs nothing more.

Each now answers as for any other value it does not recognise: the
dependency is met, a String where a Hash is declared is invalid, and an
unknown version is a 404, or a 406 under `strict`.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1490 of 1490 branches covered (100.0%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 3 files covered. (100.0%)

4325 of 4325 relevant lines covered (100.0%)

29283.3 hits per line