ruby-grape / grape
100%
master: 100%

Repo Added 04 Apr 2013 06:08AM UTC

Files 177

Badge

LAST BUILD ON BRANCH feature/strict-params
branch: feature/strict-params

CHANGE BRANCH
x

Reset

feature/strict-params

DateFormat

Handle_json_array

ISSUE-2321

Issue-1908

active_support_6_1_minimal

add-agents-md

add-coverage-100

add-tempfile-reaper

add_irb_in_gemfile_for_bundle_console_warning

add_numericality_validator

add_rack_3_2_gemfile

add_rails_8_1_on_ci

add_ruby_3_4

add_ruby_4_0_cli

api_override_singleton_methods

array-param-regression

as-explicit-kwarg

bench/version-throughput-ruby-4.0.7

benchmark/grape-on-rack

benchmark/results-machine-spec

benchmark/route-throughput-scenarios

body-metadata

bugfix/1577

bugfix/1970

bugfix/1986

bugfix/2041

bugfix/autoload

bugfix/memory-leak

build_with_registry

chore/4-0-0-release-docs

chore/agents-md-style-rules

chore/align-comments-with-code

chore/bench-4-0-0-default

chore/bench-zjit

chore/cleanup-on-compilation

chore/clear-rubocop-todo

chore/coercion-tests

chore/cover-untested-lines

chore/drop-middleware-globals

chore/guard-clause-cleanup

chore/json-parse-fallback

chore/min-ruby-3.3

chore/normalize-eql-aliases

chore/pin-git-for-danger

chore/primitive-coercer-spec

chore/prune-requires

chore/raise-dependency-lower-bounds

chore/readability-guard-clauses

chore/readability-pass

chore/require-ruby-3-3-1

chore/router-specs-without-internals

chore/rubocop-1.92-tighten-limits

chore/version-bench-master-only

chore/version-throughput-deltas

ci/coveralls-lcov

clean_up_useless_dependencies

cleanup-deprecated-code

collapse-lazy-value-tree

compile_mounted_apis_at_boot

compiled_endpoints

contract_scope_validator_public_schema

cookies_delegation

crush_desclared_params

custom-validator-namespace-lookup

declared-params-scope-kwarg

declared_params_optional_array

deprecate-positional-options-hash

deprecated_endpoint_return

doc

doc/remove_manual_toc_and_toc_danger_check

doc/remove_toc

doc/update_reload_documentation_for_current_Rails_versions

docs/format-removal-note

docs/readme-corrections

docs/readme-dot-requirement-format

docs/readme-example-fixes

docs/readme-given-renamed-param

docs/readme-param-version-and-415

docs/readme-typos-and-fixnum-cleanup

document-typed-route-requirements

draft/middleware-options-data

drop_namespace_description

drop_ruby_3_0_as_7_0

drop_support_ruby_2_7_0

dynamic_registration

empty_string_and_bool

enable_branch_coverage

enable_frozen_string_literal_ci

endpoint-options-path-aliasing

endpoint-shared-runner-lambda

endpoint_api_kwarg

endpoint_app_kwarg

endpoint_cleanup

endpoint_http_methods_kwarg

endpoint_path_kwarg

entity-dsl

eql-hash-consistency

erik/remove-faulty-documentation-about-blank-values

error-formatter-nil-guard

error-formatter-registry-lookup

exclude_ruby_3_2_rails_edge

explicit-required-flag

explicit_route_options

exposes-to-s

extract_entity_dsl_and_kwargs_with

extract_testing_module

extract_translation

failing_spec_for_1967

falcon_integration

faster_normalize_path

feat/lint-router

feat/markdown-formatter

feature/endpoint-logger

feature/error-formatter-kwargs-2527

feature/grape-api-setup-var-array

feature/hash-oneof-2385

feature/jsonl-format

feature/problem-json-error-formatter

feature/return_of_return

feature/warn-on-helper-overrides

feature_rack_lint

fix-636

fix-badges

fix-before-each-nil-nomethoderror

fix-cascade-dsl-getter

fix-coercer-request-time-state

fix-compile-instance-race

fix-docs

fix-helper-inheritance

fix-line-anchored-regexes

fix-multiple-type-values-check

fix-options-const-defined-object-fallback

fix-path-versioner-root-version

fix-router-cascade-routing-args

fix-router-cascade-sibling-routes

fix-top-level-entity-constant

fix-typo

fix-validator-non-hash-guard

fix/2748-structured-message-leak

fix/2763-multijson-deprecations

fix/api-format-undeclared-content-type

fix/array-blank-elements

fix/array-scope-non-hash-elements

fix/array-values-beginless-range

fix/auth-base-subclass-issue-2669

fix/avoid_multiple_mounts_pollution

fix/base-only-rescue-handlers

fix/base-recorded-as-setup-step

fix/binary-non-ascii-path-info

fix/cascade-reader

fix/cascade_reading_api_level

fix/cascading-routes-answer-404

fix/case-insensitive-media-types

fix/class-level-reads-not-recorded

fix/coerce-option-hash-message

fix/content-type-order-cache

fix/custom-type-coercer-symbolize-collection

fix/declared-blank-array-elements

fix/delete-default-status-invalid-encoding

fix/deprecation-horizon

fix/entity-lookup-own-class-first

fix/error-presenter-desc-failure-keyword

fix/error-raises

fix/error-rendering-failsafe

fix/failure-entity-string-message

fix/format-rejects-before-assigning

fix/grape-exceptions-precedence

fix/greedy-route-params-for

fix/group-block-needs-one-name

fix/head-around-router

fix/header-version-hyphen

fix/header-versioner-vendor-case

fix/header-versioner-version-case

fix/integer-float-truncation

fix/invalid-bytes-blank

fix/json-load-create-additions

fix/json-use-parse

fix/middleware-proc-argument

fix/multixml-deprecation

fix/negotiated-format-fallback

fix/nested-array-index-through-hash

fix/nested-array-validation-bypass

fix/nested-required-values-nil

fix/oneof-copy-containers

fix/path-param-encoding

fix/per-api-logger

fix/pin-json-below-3-legacy-gemfiles

fix/rack-mount-star-method

fix/recompile-after-route-added

fix/recompile-settings-mutation-race

fix/redirect-body-content-type

fix/redirect-plain-text-body

fix/reduce_base_route_array_allocation

fix/release-superseded-mount-instances

fix/remount-refresh-drops-sibling-mounts

fix/rescue-from-internal-errors-2482

fix/route-buckets-splat-run-on

fix/route-param-named-version

fix/route-success-failure-readers

fix/router-head-404-body

fix/router-request-time-map-mutation

fix/safe-default-rack-exception

fix/sendfile_test_fix

fix/stackable-copy-aliasing

fix/testing-opt-in

fix/validation-error-without-message

fix/variant-collection-coercer-to-s

fix/variant-collection-coercion

fix/warn-shadowed-rescue-from

fix_2566_memory_leak

fix_all_media_types_regression

fix_before_each_no_method_error

fix_coercer_cache

fix_danger_workflow

fix_endpoint_status_when_not_calling_error!

fix_gh_workflow_annotations_warnings

fix_grape_swagger_test

fix_helpers_methods_in_public_scope

fix_leaky_slash

fix_middleware_keywords

fix_param_scope_thread_safety

fix_registry_warning_message

fix_require_logger

fix_routes_memoization

fix_shared_params_empty_args

fix_style_optional_boolean_parameter

format_header_best_q_match

forward_match_kwarg

freeze-coercers-and-sync-caches

funding

happy_rubocop

head_route_on_route_class

hook-readme

improve-branch-coverage

inheritable-setting-auth-params-builder

inheritable-setting-callbacks

inheritable-setting-cheap-equality

inheritable-setting-content-negotiation

inheritable-setting-contract-key-map

inheritable-setting-finale

inheritable-setting-format-defaults

inheritable-setting-integration

inheritable-setting-middleware-helpers

inheritable-setting-params-state

inheritable-setting-representations

inheritable-setting-rescue-options

inheritable-setting-routing-flags

inheritable-setting-routing-scopes

inheritable-setting-versioning

instance-to-s-nil-fallback

instance_to_s_delegation

internalize-stackable-storage

issue-1775

issue-2385

layer1-thread-safety-invariants

layer2-concurrency-stress

lazy_block

lazy_compile

less_active_support_concern

less_parse_nested_query

master

migrate-danger-pr-comment

migrate-to-dry-configurable

mount-refresh-internal

mountable_apis

mutual_exclusive

namespace_route_param_explicit_kwargs

no-param-reassign-error-middleware

optimize/parameters-extract-options-non-mutating

optimize_api_documentation

params-declare-extraction

patch-1

perf/array-element-validation-fast-path

perf/attributes-iterator-per-pass-state

perf/auth-middleware-without-copy

perf/avoid-empty-hash-merges

perf/build-headers-each-header

perf/coerce-without-raising

perf/config-param-builder

perf/content-type-lookup

perf/declared-missing-hash-param

perf/declared-skip-empty-renames

perf/default-status-single-read

perf/eager-load-i18n

perf/endpoint-helpers-prototype

perf/ensure-content-type-in-place

perf/entity-lookup-defaults-body-read

perf/error-middleware-without-copy

perf/error-response-copies

perf/formatter-content-negotiation

perf/formatter-rack-tuple

perf/formatter-skip-rack-request

perf/header-copy-merge-bang

perf/header-versioner-accept-memo

perf/hot-path-throughput

perf/instrument-only-when-subscribed

perf/lazy-base-inheritable-new-values

perf/lazy-error-backtrace

perf/lazy-inheritable-setting-fields

perf/lazy-param-scope-tracker

perf/lazy-params-builder

perf/lazy-rescue-backtraces

perf/lazy-response-cookies

perf/lean-endpoint-copy

perf/memoize-validation-full-messages

perf/parser-errors-without-reraise

perf/path-normalizer-fast-path

perf/plain-hash-registry

perf/plain-union-fast-path

perf/precompute-middleware-caches

perf/primitive-coercer-identity-fast-path

perf/qualifying-params-given-only

perf/request-hot-path-polish

perf/request-path-and-router

perf/request-path-throughput

perf/resolve-cascade-once

perf/root-scope-validation-fast-path

perf/route-buckets

perf/routed-version-fast-path

perf/router-transaction-no-proc

perf/routing-args-in-place-merge

perf/routing-args-single-hash

perf/scrub-extension-only

perf/share-content-type-tables

perf/shared-formatter-and-empty-filters

perf/skip-capture-free-param-extraction

perf/skip-covered-neighbours

perf/skip-default-version-pattern

perf/skip-empty-validation-errors-alloc

perf/skip-redundant-routing-args-write

perf/skip-validation-backtrace

perf/stackable-empty-singleton

perf/static-route-matching

perf/translate-error-format-once

perf/trim-request-allocations

perf/union-match-path-captures

perf/version-capture-regexp

perf/versioner-header-without-copy

perf/versioner-options-ivars

perf/versioner-path-prefix

perf/versioner-prefix-each

perf/versioner-reuses-route-capture

precompiled_json

private_namespace_reverse_stackable_with_hash

private_within_namespace

query-http-method

rack_request_error

ractor-mode

raise-rescue-handler-errors

real-api-integration-test

reduce_array_alloc_on_setup

refactor/abc-size

refactor/api-instance-dsl-modules

refactor/attrs_iterator

refactor/auth-dsl-kwargs

refactor/available-media-types-attr-reader

refactor/base-validator-encapsulation

refactor/blank-for-outside-input

refactor/coerce-options-data

refactor/cyclomatic-complexity

refactor/de-morgan-conditions

refactor/declared-contract-key-map

refactor/declared-params-handler

refactor/declared_availability

refactor/define-method-cleanup

refactor/drop-boolean-build

refactor/drop-indifferent-and-reverse-merge-requires

refactor/dsl-group-validators-dry

refactor/encapsulate-reverse-stackable

refactor/endpoint-options-data

refactor/endpoint-options-route-enabled

refactor/error-middleware-options

refactor/error-response-data

refactor/error-response-value-object

refactor/extract-handler-case-when

refactor/extract-path-normalizer

refactor/fold-attributes-iterators

refactor/guard-clauses-style

refactor/header-versioner-branches

refactor/inheritable-setting-accessors

refactor/inline-mustermann-grape

refactor/lazy-base-ancestor

refactor/merge-headers-guard

refactor/middleware-cleanups

refactor/module-length

refactor/mountable-marker

refactor/named_kwargs_params_scope

refactor/nest-path-in-pattern

refactor/params-dsl-using-except-kwargs

refactor/params-scope-resolution

refactor/path-versioner-dead-routed-check

refactor/perceived-complexity

refactor/precomputed-content-types-move

refactor/replace-tap-usages

refactor/requires-optional-one-definition

refactor/rescue-from-explicit-first-arg

refactor/rescue-handler-dedup

refactor/router-branches

refactor/router-miss-and-cascade

refactor/router-miss-and-cascade-paths

refactor/router-pattern-delegation

refactor/router-simplification

refactor/scrub-helper

refactor/shared-options-data

refactor/stateless-attributes-iterator

refactor/validates-pure-helpers

refactor/validation-errors-drop-enumerable

refactor/validations-spec-self-validate

refactor/version-guard-clause

refactor/xml-error-formatter-to-xml

refactor_available_media_types_in_header_middleware

refactor_declared_params_handling

refactor_http_headers

refactor_mime_type_for

refactor_route_setting_internal_usage

refactor_setting_get_or_set

refs/heads/master

refs/tags/v1.7.1

refs/tags/v1.8.0

refs/tags/v2.0.0

registry-frozen-copy-on-write

regression/json-error-formatter-double-wrap

release/3.2.1

remove-inheritable-values

remove-reverse-stackable-values

remove-unused-constant

remove/deprecations-3-3

remove/http-digest-dsl

remove_deprecated_param_builder_extensions

remove_guard

remove_instance_variable_defined

remove_namespace_reverse_stackable_from_public_interface

remove_namespace_stackable_and_inheritable_from_public_space

remove_namespace_stackable_with_hash_from_public_interface

remove_non_supported_jsonapi

remove_obsolete_docker_compose_version

remove_path_dup

remove_pattern_format

remove_settings_unset_functions

remove_strict_hash_configuration

remove_test_prof

replace_try_by_respond_to

request-params-builder-identity-copy

rescue_from

resolve_performace_issue_with_given

restore-routing-args-per-attempt

revert-1953-chore/micto-optimization-3

revert-2726-refactor/stateless-attributes-iterator

revert-2774-forward_match_kwarg

revert-wrong-commit

revisit_auth_middleware

revisit_endpoint_helpers_and_new

revisit_middleware_default_options

revisit_validators

robust_mounted_app_comparison

route-default-hash-collision

route-default-reads-description-key

route-default-response-alias

route-param-bare-requirements

route-scope-accessors

route_attributes_kwargs

route_match_params_via_pattern

router-compile-registered-methods

router-pattern-drop-unused-mustermann-caches

rubocop-mutable-constant-recursive

ruby3_handling_argument_delegation

ruby_3_1_shorthand_kwargs

ruby_optimizations

ruby_style_send

security/mounted-rack-auth-and-html-escape

skip_instrumentation_no_validators

skip_run_filters_on_empty

small_refactor_versioner_middleware

spec-only-rack-class

spec-railtie-load-order

spec/api-class-delegation

spec/compose-message-blank-step

spec/error-presenter-branches

spec/failsafe-without-rack-errors

spec/formatter-bodyless-input

spec/present-version-embed

standardize-error-messages

support-open-ranges-values

test-adversarial-nesting-depth

test/grape-swagger-integration

translator-seam

try_pattern_instead_of_respond_to

unify-group-type-check

untangle_route_params

update-simplecov

update_min_ruby_version_and_rubocop

update_return_upgrading_notes_and_simplify_execute

update_rubocop

update_rubocop_1_71_2

update_rubocop_1_88

update_rubocop_1_90

update_rubocop_and_autocorrect

upgrade-mustermann

upgrade-rubocop

upgrading-array-unknown-element-type

upgrading-description

use_forwardable

use_require_relative_in_gemspec

v0.19.2

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.1.0

v1.2.0

v1.2.1

v1.2.2

v1.2.3

v1.2.4

v1.2.5

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.4.0

v1.5.0

v1.5.1

v2.1.0

v2.1.1

v2.1.2

v2.1.3

v2.2.0

v2.3.0

v2.4.0

v3.0.0

v3.0.1

v3.1.0

v3.1.1

v3.2.0

v3.2.1

v3.3.0

v3.3.1

v3.3.1_release

v3.3.2

v3.3.2_release

v3.3.3

v3.3.3_release

v3.3.4

v3.3.4_release

v3.3.5

v3.3.5_release

v4.0.0

v4.0.1

v4.0.1_release

v4.1.0

valid_encoding_before_scrubing

validators-hold-static-values-directly

validators_bad_encoding

Committed 03 Nov 2026 08:57AM UTC coverage: 100.0%. Remained the same

Build # 41607189545

Build Type

github

Committed by

Commit Message

Add Grape.config.reject_undeclared_params to answer 400 to undeclared params

With the setting on, a request carrying a param its endpoint did not
declare is answered 400, the undeclared params reported in the same
Grape::Exceptions::ValidationErrors as the other validation errors, with
the message "is not allowed".

Declared are the names of the endpoint's params blocks (its own and its
namespaces', given blocks included, renamed params by the name sent), a
contract's keys, the route's path params, and format. Hash, Array and
JSON params are looked into key by key and named by path, as in
items[1][price]. The check runs after the validators, so a JSON param
sent as a String is looked into as the Hash it is coerced to.

The declared names are folded into a frozen tree at compile!, held in
Endpoint::State. A request with no query string and no body is let
through without building params.

The setting is off by default, and Grape 5.0 turns it on.

Fixes #2241. Refs #2416.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Pull Request Pull Request #3054: Add Grape.config.reject_undeclared_params to answer 400 to undeclared params

Coverage Stats

1553 of 1553 branches covered (100.0%)

Branch coverage included in aggregate %.

73 of 73 new or added lines in 5 files covered. (100.0%)

4594 of 4594 relevant lines covered (100.0%)

30655.41 hits per line

Relevant lines Covered

4594 RELEVANT LINES 4594 COVERED LINES

30655.41 HITS PER LINE

Source Files on feature/strict-params

Recent builds

Builds	Branch	Commit	Type	Ran	Committer	Via	Coverage
41607189545	feature/strict-params	Add Grape.config.reject_undeclared_params to answer 400 to undeclared params With the setting on, a request carrying a param its endpoint did not declare is answered 400, the undeclared params reported in the same Grape::Exceptions::ValidationErr...	Pull #3054	03 Nov 2026 08:58AM UTC	ericproulx	github	100.0
41607155090	feature/strict-params	Add Grape.config.reject_undeclared_params to answer 400 to undeclared params With the setting on, a request carrying a param its endpoint did not declare is answered 400, the undeclared params reported in the same Grape::Exceptions::ValidationErr...	Pull #3054	03 Nov 2026 08:57AM UTC	ericproulx	github	100.0

See All Builds (4392)