ruby-grape / grape
97%
master: 99%

LAST BUILD BRANCH: feat/lint-router
DEFAULT BRANCH: master
Repo Added
Files 167
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/path-param-encoding
branch: fix/path-param-encoding
CHANGE BRANCH
x

coverage: 96.993% (-0.01%) from 97.006%
32581308376

Pull #2839

github

ericproulx 
Tag path params as UTF-8 instead of leaving them binary

Mustermann decodes path captures out of PATH_INFO, which Rack hands over
tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params
arrive UTF-8 because Rack tags those itself, so the same value reached the
endpoint with a different encoding depending on where it came from.

That made an API's declarations disagree with themselves -- a binary string
never equals the UTF-8 literal it was written as:

    params { requires :id, type: String, values: ['café'] }

    GET /?id=café   ->  200
    GET /café       ->  400 "id does not have a valid value"

The same held for same_as, except_values and any comparison an endpoint made
against a non-ASCII literal. It also leaked into serialization: a non-ASCII
path param rendered into a JSON response drew an encoding warning from the
json gem, which that gem says will become an error in json 3.0.

Re-tag in Route#params_for, the single funnel for path-extracted values.

Nothing obliges a client to send UTF-8 -- HTTP treats the request target as
octets, and Rack's SPEC has CGI keys carry non-ASCII as ASCII-8BIT -- so
UTF-8 is the convention rather than a guarantee: it is what browsers
percent-encode with, what an IRI maps to, and what Rails settles on
(ActionDispatch::Journey::Router force_encodes every path capture to UTF-8
after unescaping it). Only the encoding changes here: the bytes are
untouched, so octets that are not UTF-8 stay invalid and are still caught
downstream instead of being silently scrubbed into something the client
never sent. Unnamed splats capture into an Array, so those are walked too.

The re-tag is unconditional and in place, hence tag_utf8!. That is safe
rather than merely cheap: Mustermann's Pattern#params builds a fresh Hash of
fresh, unfrozen strings on every call and skips its own Match cache, so the
mutation cannot escape the request. It is also what lets the Array branch
re-tag its elements with each.

Since eve... (continued)
Pull Request #2839: Tag path params as UTF-8 instead of leaving them binary

1223 of 1312 branches covered (93.22%)

Branch coverage included in aggregate %.

7 of 8 new or added lines in 1 file covered. (87.5%)

3842 of 3910 relevant lines covered (98.26%)

27164.93 hits per line

Relevant lines Covered
3910 RELEVANT LINES 3842 COVERED LINES
27164.93 HITS PER LINE
Source Files on fix/path-param-encoding

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
32581308376 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.99
32471316267 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.99
32468732098 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.99
32468638504 fix/path-param-encoding Merge branch 'master' into fix/path-param-encoding Pull #2839 web-flow github
96.99
32342415402 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.99
32341163255 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.99
32173652946 fix/path-param-encoding Merge branch 'master' into fix/path-param-encoding Pull #2839 web-flow github
96.97
30716593749 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary Mustermann decodes path captures out of PATH_INFO, which Rack hands over tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params arrive UTF-8 because Rack tags those itsel... Pull #2839 ericproulx github
96.96
30704695691 fix/path-param-encoding Merge 720e518d7 into 32e481451 Pull #2839 GitHub github
96.96
30704694487 fix/path-param-encoding Tag path params as UTF-8 instead of leaving them binary push Eric Proulx github
96.96
See All Builds (3964)