ruby-grape / grape / 42520358877

100%

push

github

Add Grape.config.allow_undeclared_params; false answers 400 to undeclared params (#3054)

With the setting false, a request carrying a param its endpoint did not
declare is answered 400, the undeclared params reported in the same
Grape::Exceptions::ValidationErrors as the other validation errors, with
the message "is not allowed".

Declared are the names of the endpoint's params blocks (its own and its
namespaces', given blocks included, renamed params by the name sent), a
contract's keys, the route's path params, and format. Hash, Array and
JSON params are looked into key by key and named by path, as in
items[1][price]. The check runs after the validators, so a JSON param
sent as a String is looked into as the Hash it is coerced to.

The declared names are folded into a frozen tree at compile!, held in
Endpoint::State. A request with no query string and no body is let
through without building params.

The setting defaults to true, which keeps today's behaviour, and Grape
5.0 makes false the default.

Fixes #2241. Refs #2416.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1575 of 1575 branches covered (100.0%)

Branch coverage included in aggregate %.

73 of 73 new or added lines in 5 files covered. (100.0%)

4641 of 4641 relevant lines covered (100.0%)

19267.93 hits per line