ruby-grape / grape / 42265450761

100%

master: 100%

Pull #3058

github

Add rexml as a dependency

Without multi_xml, Grape parses XML request bodies with
ActiveSupport::XmlMini, whose default backend requires rexml/document.
rexml has been a bundled gem rather than a default one since Ruby 3.0,
so under Bundler it loads only when something in the bundle depends on
it, and nothing Grape depends on does. In an app whose bundle holds
just Grape, an XML body raised

    LoadError: cannot load such file -- rexml/document

which is not a StandardError, so even rescue_from :all let it through
to the server. Grape's own XML specs passed only because Danger's
kramdown dependency happened to bring rexml into the test bundle.

The floor is 3.4.2, the first release with every advisory in
ruby-advisory-db patched; the latest, CVE-2025-58767, is a DoS on
malformed XML, which is what an API parses from untrusted clients.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1511 of 1529 branches covered (98.82%)

Branch coverage included in aggregate %.

4526 of 4567 relevant lines covered (99.1%)

12866.19 hits per line