ruby-grape / grape
97%
master: 97%

LAST BUILD BRANCH: fix/adversarial-sweep-2026-08
DEFAULT BRANCH: master
Repo Added
Files 167
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/path-param-encoding
branch: fix/path-param-encoding
CHANGE BRANCH
x

coverage: 96.964% (-0.01%) from 96.976%
30716593749

Pull #2839

github

ericproulx 
Tag path params as UTF-8 instead of leaving them binary

Mustermann decodes path captures out of PATH_INFO, which Rack hands over
tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params
arrive UTF-8 because Rack tags those itself, so the same value reached the
endpoint with a different encoding depending on where it came from.

That made an API's declarations disagree with themselves -- a binary string
never equals the UTF-8 literal it was written as:

    params { requires :id, type: String, values: ['café'] }

    GET /?id=café   ->  200
    GET /café       ->  400 "id does not have a valid value"

The same held for same_as, except_values and any comparison an endpoint made
against a non-ASCII literal. It also leaked into serialization: a non-ASCII
path param rendered into a JSON response drew an encoding warning from the
json gem, which that gem says will become an error in json 3.0.

Re-tag in Route#params_for, the single funnel for path-extracted values.

Nothing obliges a client to send UTF-8 -- HTTP treats the request target as
octets, and Rack's SPEC has CGI keys carry non-ASCII as ASCII-8BIT -- so
UTF-8 is the convention rather than a guarantee: it is what browsers
percent-encode with, what an IRI maps to, and what Rails settles on
(ActionDispatch::Journey::Router force_encodes every path capture to UTF-8
after unescaping it). Only the encoding changes here: the bytes are
untouched, so octets that are not UTF-8 stay invalid and are still caught
downstream instead of being silently scrubbed into something the client
never sent. Unnamed splats capture into an Array, so those are walked too.

No extra allocations -- the captures are freshly built and unfrozen, so the
re-tag happens in place.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Pull Request #2839: Tag path params as UTF-8 instead of leaving them binary

1202 of 1291 branches covered (93.11%)

Branch coverage included in aggregate %.

6 of 7 new or added lines in 1 file covered. (85.71%)

1 existing line in 1 file now uncovered.

3812 of 3880 relevant lines covered (98.25%)

26780.64 hits per line

Relevant lines Covered
3880 RELEVANT LINES 3812 COVERED LINES
26780.64 HITS PER LINE
Source Files on fix/path-param-encoding

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
30716593749 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.96
30704695691 fix/path-param-encoding Merge 720e518d7 into 32e481451 Pull #2839 GitHub github
96.96
30704694487 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary push Eric Proulx github
96.96
30697267026 fix/path-param-encoding Merge 2fffb2e34 into 32e481451 Pull #2839 GitHub github
96.96
30697265576 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary push Eric Proulx github
96.96
30490601901 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.96
30490575051 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... push ericproulx github
96.96
See All Builds (3445)