ruby-grape / grape

100%

master: 100%

LAST BUILD ON BRANCH fix/cascade-allowed-methods-leak

branch: fix/cascade-allowed-methods-leak

CHANGE BRANCH

x

Reset

• fix/cascade-allowed-methods-leak
• DateFormat
• Handle_json_array
• ISSUE-2321
• Issue-1908
• active_support_6_1_minimal
• add-agents-md
• add-coverage-100
• add-tempfile-reaper
• add_irb_in_gemfile_for_bundle_console_warning
• add_numericality_validator
• add_rack_3_2_gemfile
• add_rails_8_1_on_ci
• add_ruby_3_4
• add_ruby_4_0_cli
• api_override_singleton_methods
• array-param-regression
• as-explicit-kwarg
• bench/version-throughput-ruby-4.0.7
• benchmark/grape-on-rack
• benchmark/results-machine-spec
• benchmark/route-throughput-scenarios
• body-metadata
• bugfix/1577
• bugfix/1970
• bugfix/1986
• bugfix/2041
• bugfix/autoload
• bugfix/memory-leak
• build_with_registry
• chore/4-0-0-release-docs
• chore/agents-md-style-rules
• chore/align-comments-with-code
• chore/bench-4-0-0-default
• chore/bench-zjit
• chore/cleanup-on-compilation
• chore/clear-rubocop-todo
• chore/coercion-tests
• chore/cover-untested-lines
• chore/drop-middleware-globals
• chore/drop-rails-7-2
• chore/guard-clause-cleanup
• chore/json-parse-fallback
• chore/min-ruby-3.3
• chore/normalize-eql-aliases
• chore/pin-git-for-danger
• chore/primitive-coercer-spec
• chore/prune-requires
• chore/raise-dependency-lower-bounds
• chore/readability-guard-clauses
• chore/readability-pass
• chore/replace-danger-with-changelog-check
• chore/require-ruby-3-3-1
• chore/router-specs-without-internals
• chore/rubocop-1.92-tighten-limits
• chore/version-bench-master-only
• chore/version-throughput-deltas
• ci/coveralls-lcov
• clean_up_useless_dependencies
• cleanup-deprecated-code
• collapse-lazy-value-tree
• compile_mounted_apis_at_boot
• compiled_endpoints
• contract_scope_validator_public_schema
• cookies_delegation
• crush_desclared_params
• custom-validator-namespace-lookup
• declared-params-scope-kwarg
• declared_params_optional_array
• deprecate-positional-options-hash
• deprecated_endpoint_return
• doc
• doc/remove_manual_toc_and_toc_danger_check
• doc/remove_toc
• doc/update_reload_documentation_for_current_Rails_versions
• docs/format-removal-note
• docs/readme-corrections
• docs/readme-dot-requirement-format
• docs/readme-example-fixes
• docs/readme-given-renamed-param
• docs/readme-param-version-and-415
• docs/readme-typos-and-fixnum-cleanup
• document-typed-route-requirements
• draft/middleware-options-data
• drop_namespace_description
• drop_ruby_3_0_as_7_0
• drop_support_ruby_2_7_0
• dynamic_registration
• empty_string_and_bool
• enable_branch_coverage
• enable_frozen_string_literal_ci
• endpoint-options-path-aliasing
• endpoint-shared-runner-lambda
• endpoint_api_kwarg
• endpoint_app_kwarg
• endpoint_cleanup
• endpoint_http_methods_kwarg
• endpoint_path_kwarg
• entity-dsl
• eql-hash-consistency
• erik/remove-faulty-documentation-about-blank-values
• error-formatter-nil-guard
• error-formatter-registry-lookup
• exclude_ruby_3_2_rails_edge
• explicit-required-flag
• explicit_route_options
• exposes-to-s
• extract_entity_dsl_and_kwargs_with
• extract_testing_module
• extract_translation
• failing_spec_for_1967
• falcon_integration
• faster_normalize_path
• feat/lint-router
• feat/markdown-formatter
• feature/endpoint-logger
• feature/error-formatter-kwargs-2527
• feature/grape-api-setup-var-array
• feature/hash-oneof-2385
• feature/jsonl-format
• feature/problem-json-error-formatter
• feature/return_of_return
• feature/strict-params
• feature/warn-on-helper-overrides
• feature_rack_lint
• fix-636
• fix-badges
• fix-before-each-nil-nomethoderror
• fix-cascade-dsl-getter
• fix-coercer-request-time-state
• fix-compile-instance-race
• fix-docs
• fix-helper-inheritance
• fix-line-anchored-regexes
• fix-multiple-type-values-check
• fix-options-const-defined-object-fallback
• fix-path-versioner-root-version
• fix-router-cascade-routing-args
• fix-router-cascade-sibling-routes
• fix-top-level-entity-constant
• fix-typo
• fix-validator-non-hash-guard
• fix/2748-structured-message-leak
• fix/2763-multijson-deprecations
• fix/api-format-undeclared-content-type
• fix/array-blank-elements
• fix/array-scope-non-hash-elements
• fix/array-values-beginless-range
• fix/auth-base-subclass-issue-2669
• fix/avoid_multiple_mounts_pollution
• fix/base-only-rescue-handlers
• fix/base-recorded-as-setup-step
• fix/binary-non-ascii-path-info
• fix/cascade-reader
• fix/cascade_reading_api_level
• fix/cascading-routes-answer-404
• fix/case-insensitive-media-types
• fix/class-level-reads-not-recorded
• fix/coerce-option-hash-message
• fix/content-type-order-cache
• fix/custom-type-coercer-symbolize-collection
• fix/declare-rexml-dependency
• fix/declared-blank-array-elements
• fix/delete-default-status-invalid-encoding
• fix/deprecation-horizon
• fix/entity-lookup-own-class-first
• fix/error-presenter-desc-failure-keyword
• fix/error-raises
• fix/error-rendering-failsafe
• fix/failure-entity-string-message
• fix/format-rejects-before-assigning
• fix/grape-exceptions-precedence
• fix/greedy-route-params-for
• fix/group-block-needs-one-name
• fix/head-around-router
• fix/header-version-hyphen
• fix/header-versioner-vendor-case
• fix/header-versioner-version-case
• fix/integer-float-truncation
• fix/invalid-bytes-blank
• fix/json-load-create-additions
• fix/json-use-parse
• fix/middleware-proc-argument
• fix/multixml-deprecation
• fix/negotiated-format-fallback
• fix/nested-array-index-through-hash
• fix/nested-array-validation-bypass
• fix/nested-required-values-nil
• fix/oneof-copy-containers
• fix/path-param-encoding
• fix/per-api-logger
• fix/pin-json-below-3-legacy-gemfiles
• fix/rack-mount-star-method
• fix/recompile-after-route-added
• fix/recompile-settings-mutation-race
• fix/redirect-body-content-type
• fix/redirect-plain-text-body
• fix/reduce_base_route_array_allocation
• fix/release-superseded-mount-instances
• fix/remount-refresh-drops-sibling-mounts
• fix/rescue-from-internal-errors-2482
• fix/route-buckets-splat-run-on
• fix/route-param-named-version
• fix/route-success-failure-readers
• fix/router-head-404-body
• fix/router-request-time-map-mutation
• fix/safe-default-rack-exception
• fix/sendfile_test_fix
• fix/stackable-copy-aliasing
• fix/testing-opt-in
• fix/validation-error-without-message
• fix/variant-collection-coercer-to-s
• fix/variant-collection-coercion
• fix/version-positional-options
• fix/warn-shadowed-rescue-from
• fix_2566_memory_leak
• fix_all_media_types_regression
• fix_before_each_no_method_error
• fix_coercer_cache
• fix_danger_workflow
• fix_endpoint_status_when_not_calling_error!
• fix_gh_workflow_annotations_warnings
• fix_grape_swagger_test
• fix_helpers_methods_in_public_scope
• fix_leaky_slash
• fix_middleware_keywords
• fix_param_scope_thread_safety
• fix_registry_warning_message
• fix_require_logger
• fix_routes_memoization
• fix_shared_params_empty_args
• fix_style_optional_boolean_parameter
• format_header_best_q_match
• forward_match_kwarg
• freeze-coercers-and-sync-caches
• funding
• happy_rubocop
• head_route_on_route_class
• hook-readme
• improve-branch-coverage
• inheritable-setting-auth-params-builder
• inheritable-setting-callbacks
• inheritable-setting-cheap-equality
• inheritable-setting-content-negotiation
• inheritable-setting-contract-key-map
• inheritable-setting-finale
• inheritable-setting-format-defaults
• inheritable-setting-integration
• inheritable-setting-middleware-helpers
• inheritable-setting-params-state
• inheritable-setting-representations
• inheritable-setting-rescue-options
• inheritable-setting-routing-flags
• inheritable-setting-routing-scopes
• inheritable-setting-versioning
• instance-to-s-nil-fallback
• instance_to_s_delegation
• internalize-stackable-storage
• issue-1775
• issue-2385
• layer1-thread-safety-invariants
• layer2-concurrency-stress
• lazy_block
• lazy_compile
• less_active_support_concern
• less_parse_nested_query
• master
• migrate-danger-pr-comment
• migrate-to-dry-configurable
• mount-refresh-internal
• mountable_apis
• mutual_exclusive
• namespace_route_param_explicit_kwargs
• no-param-reassign-error-middleware
• optimize/parameters-extract-options-non-mutating
• optimize_api_documentation
• params-declare-extraction
• patch-1
• perf/array-element-validation-fast-path
• perf/attributes-iterator-per-pass-state
• perf/auth-middleware-without-copy
• perf/avoid-empty-hash-merges
• perf/build-headers-each-header
• perf/coerce-without-raising
• perf/config-param-builder
• perf/content-type-lookup
• perf/declared-missing-hash-param
• perf/declared-skip-empty-renames
• perf/default-status-single-read
• perf/eager-load-i18n
• perf/endpoint-helpers-prototype
• perf/ensure-content-type-in-place
• perf/entity-lookup-defaults-body-read
• perf/error-middleware-without-copy
• perf/error-response-copies
• perf/formatter-content-negotiation
• perf/formatter-rack-tuple
• perf/formatter-skip-rack-request
• perf/header-copy-merge-bang
• perf/header-versioner-accept-memo
• perf/hot-path-throughput
• perf/instrument-only-when-subscribed
• perf/lazy-base-inheritable-new-values
• perf/lazy-error-backtrace
• perf/lazy-inheritable-setting-fields
• perf/lazy-param-scope-tracker
• perf/lazy-params-builder
• perf/lazy-rescue-backtraces
• perf/lazy-response-cookies
• perf/lean-endpoint-copy
• perf/memoize-validation-full-messages
• perf/parser-errors-without-reraise
• perf/path-normalizer-fast-path
• perf/plain-hash-registry
• perf/plain-union-fast-path
• perf/precompute-middleware-caches
• perf/primitive-coercer-identity-fast-path
• perf/qualifying-params-given-only
• perf/request-hot-path-polish
• perf/request-path-and-router
• perf/request-path-throughput
• perf/resolve-cascade-once
• perf/root-scope-validation-fast-path
• perf/route-buckets
• perf/routed-version-fast-path
• perf/router-transaction-no-proc
• perf/routing-args-in-place-merge
• perf/routing-args-single-hash
• perf/scrub-extension-only
• perf/share-content-type-tables
• perf/shared-formatter-and-empty-filters
• perf/skip-capture-free-param-extraction
• perf/skip-covered-neighbours
• perf/skip-default-version-pattern
• perf/skip-empty-validation-errors-alloc
• perf/skip-redundant-routing-args-write
• perf/skip-validation-backtrace
• perf/stackable-empty-singleton
• perf/static-route-matching
• perf/translate-error-format-once
• perf/trim-request-allocations
• perf/union-match-path-captures
• perf/version-capture-regexp
• perf/versioner-header-without-copy
• perf/versioner-options-ivars
• perf/versioner-path-prefix
• perf/versioner-prefix-each
• perf/versioner-reuses-route-capture
• precompiled_json
• private_namespace_reverse_stackable_with_hash
• private_within_namespace
• query-http-method
• rack_request_error
• ractor-mode
• raise-rescue-handler-errors
• real-api-integration-test
• reduce_array_alloc_on_setup
• refactor/abc-size
• refactor/api-instance-dsl-modules
• refactor/attrs_iterator
• refactor/auth-dsl-kwargs
• refactor/available-media-types-attr-reader
• refactor/base-validator-encapsulation
• refactor/blank-for-outside-input
• refactor/coerce-options-data
• refactor/cyclomatic-complexity
• refactor/de-morgan-conditions
• refactor/declared-contract-key-map
• refactor/declared-params-handler
• refactor/declared_availability
• refactor/define-method-cleanup
• refactor/drop-boolean-build
• refactor/drop-indifferent-and-reverse-merge-requires
• refactor/dsl-group-validators-dry
• refactor/encapsulate-reverse-stackable
• refactor/endpoint-options-data
• refactor/endpoint-options-route-enabled
• refactor/error-middleware-options
• refactor/error-response-data
• refactor/error-response-value-object
• refactor/extract-handler-case-when
• refactor/extract-path-normalizer
• refactor/fold-attributes-iterators
• refactor/guard-clauses-style
• refactor/header-versioner-branches
• refactor/inheritable-setting-accessors
• refactor/inline-mustermann-grape
• refactor/lazy-base-ancestor
• refactor/merge-headers-guard
• refactor/middleware-cleanups
• refactor/module-length
• refactor/mountable-marker
• refactor/named_kwargs_params_scope
• refactor/nest-path-in-pattern
• refactor/params-dsl-using-except-kwargs
• refactor/params-scope-resolution
• refactor/path-versioner-dead-routed-check
• refactor/perceived-complexity
• refactor/precomputed-content-types-move
• refactor/replace-tap-usages
• refactor/requires-optional-one-definition
• refactor/rescue-from-explicit-first-arg
• refactor/rescue-handler-dedup
• refactor/router-branches
• refactor/router-miss-and-cascade
• refactor/router-miss-and-cascade-paths
• refactor/router-pattern-delegation
• refactor/router-simplification
• refactor/scrub-helper
• refactor/shared-options-data
• refactor/stateless-attributes-iterator
• refactor/validates-pure-helpers
• refactor/validation-errors-drop-enumerable
• refactor/validations-spec-self-validate
• refactor/version-guard-clause
• refactor/xml-error-formatter-to-xml
• refactor_available_media_types_in_header_middleware
• refactor_declared_params_handling
• refactor_http_headers
• refactor_mime_type_for
• refactor_route_setting_internal_usage
• refactor_setting_get_or_set
• refs/heads/master
• refs/tags/v1.7.1
• refs/tags/v1.8.0
• refs/tags/v2.0.0
• registry-frozen-copy-on-write
• regression/json-error-formatter-double-wrap
• release/3.2.1
• remove-inheritable-values
• remove-reverse-stackable-values
• remove-unused-constant
• remove/deprecations-3-3
• remove/http-digest-dsl
• remove_deprecated_param_builder_extensions
• remove_guard
• remove_instance_variable_defined
• remove_namespace_reverse_stackable_from_public_interface
• remove_namespace_stackable_and_inheritable_from_public_space
• remove_namespace_stackable_with_hash_from_public_interface
• remove_non_supported_jsonapi
• remove_obsolete_docker_compose_version
• remove_path_dup
• remove_pattern_format
• remove_settings_unset_functions
• remove_strict_hash_configuration
• remove_test_prof
• replace_try_by_respond_to
• request-params-builder-identity-copy
• rescue_from
• resolve_performace_issue_with_given
• restore-routing-args-per-attempt
• revert-1953-chore/micto-optimization-3
• revert-2726-refactor/stateless-attributes-iterator
• revert-2774-forward_match_kwarg
• revert-wrong-commit
• revisit_auth_middleware
• revisit_endpoint_helpers_and_new
• revisit_middleware_default_options
• revisit_validators
• robust_mounted_app_comparison
• route-default-hash-collision
• route-default-reads-description-key
• route-default-response-alias
• route-param-bare-requirements
• route-scope-accessors
• route_attributes_kwargs
• route_match_params_via_pattern
• router-compile-registered-methods
• router-pattern-drop-unused-mustermann-caches
• rubocop-mutable-constant-recursive
• ruby3_handling_argument_delegation
• ruby_3_1_shorthand_kwargs
• ruby_optimizations
• ruby_style_send
• security/mounted-rack-auth-and-html-escape
• skip_instrumentation_no_validators
• skip_run_filters_on_empty
• small_refactor_versioner_middleware
• spec-only-rack-class
• spec-railtie-load-order
• spec/api-class-delegation
• spec/compose-message-blank-step
• spec/error-presenter-branches
• spec/failsafe-without-rack-errors
• spec/formatter-bodyless-input
• spec/present-version-embed
• standardize-error-messages
• support-open-ranges-values
• test-adversarial-nesting-depth
• test/grape-swagger-integration
• translator-seam
• try_pattern_instead_of_respond_to
• unify-group-type-check
• untangle_route_params
• update-simplecov
• update_min_ruby_version_and_rubocop
• update_return_upgrading_notes_and_simplify_execute
• update_rubocop
• update_rubocop_1_71_2
• update_rubocop_1_88
• update_rubocop_1_90
• update_rubocop_and_autocorrect
• upgrade-mustermann
• upgrade-rubocop
• upgrading-array-unknown-element-type
• upgrading-description
• use_forwardable
• use_require_relative_in_gemspec
• v0.19.2
• v1.0.0
• v1.0.1
• v1.0.2
• v1.0.3
• v1.1.0
• v1.2.0
• v1.2.1
• v1.2.2
• v1.2.3
• v1.2.4
• v1.2.5
• v1.3.0
• v1.3.1
• v1.3.2
• v1.3.3
• v1.4.0
• v1.5.0
• v1.5.1
• v2.1.0
• v2.1.1
• v2.1.2
• v2.1.3
• v2.2.0
• v2.3.0
• v2.4.0
• v3.0.0
• v3.0.1
• v3.1.0
• v3.1.1
• v3.2.0
• v3.2.1
• v3.3.0
• v3.3.1
• v3.3.1_release
• v3.3.2
• v3.3.2_release
• v3.3.3
• v3.3.3_release
• v3.3.4
• v3.3.4_release
• v3.3.5
• v3.3.5_release
• v4.0.0
• v4.0.1
• v4.0.1_release
• v4.1.0
• valid_encoding_before_scrubing
• validators-hold-static-values-directly
• validators_bad_encoding

Build # 42261199932

Build Type

Pull #3055

github

Committed by ericproulx

Commit Message

Keep grape.allowed_methods from leaking into the next app's env

When a path has no route for the request's method, the router answers
through the allowed-methods route and sets env['grape.allowed_methods']
so the endpoint knows to answer 405 (or auto-OPTIONS) instead of running
a route block. The key was never removed. Rack::Cascade moves on from a
405 to its next app with the same env, so when that app was another
Grape API, its endpoint found the key and answered 405 as well, even for
a route that matched the method:

    Rack::Cascade.new([
      Class.new(Grape::API) { get('/items') { 'index' } },
      Class.new(Grape::API) { post('/items') { 'create' } }
    ])
    # POST /items -> 405, from the second API

The allowed-methods route now goes through its own
process_allowed_methods_route, which publishes the key for as long as
the route runs and deletes it in an ensure. The endpoint and the header
versioner, which read it, both run inside that call. process_route
loses its include_allow_header keyword.

Found while triaging #1534.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Pull Request Pull Request #3055: Keep grape.allowed_methods from leaking into the next app's env

Coverage Stats

1529 of 1529 branches covered (100.0%)

Branch coverage included in aggregate %.

7 of 7 new or added lines in 1 file covered. (100.0%)

4567 of 4567 relevant lines covered (100.0%)

30877.54 hits per line