ruby-grape / grape / 41607189545

100%

master: 100%

Pull #3054

github

Add Grape.config.reject_undeclared_params to answer 400 to undeclared params

With the setting on, a request carrying a param its endpoint did not
declare is answered 400, the undeclared params reported in the same
Grape::Exceptions::ValidationErrors as the other validation errors, with
the message "is not allowed".

Declared are the names of the endpoint's params blocks (its own and its
namespaces', given blocks included, renamed params by the name sent), a
contract's keys, the route's path params, and format. Hash, Array and
JSON params are looked into key by key and named by path, as in
items[1][price]. The check runs after the validators, so a JSON param
sent as a String is looked into as the Hash it is coerced to.

The declared names are folded into a frozen tree at compile!, held in
Endpoint::State. A request with no query string and no body is let
through without building params.

The setting is off by default, and Grape 5.0 turns it on.

Fixes #2241. Refs #2416.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1553 of 1553 branches covered (100.0%)

Branch coverage included in aggregate %.

73 of 73 new or added lines in 5 files covered. (100.0%)

4594 of 4594 relevant lines covered (100.0%)

30655.41 hits per line