ruby-grape / grape / 29091554593 / 5

97%

master: 97%

Pull #2789

github

Harden mounted-app auth surface and error HTML escaping

Two security-relevant fixes surfaced by a review of Grape::API:

- Grape::Middleware::Error#rack_response only escaped the error message
  when the response content-type was exactly 'text/html', so a
  parameterized value such as 'text/html; charset=utf-8' skipped escaping
  and could reflect an unescaped message into an HTML response. Compare the
  media type only.

- A bare Rack app mounted with `mount` is called directly and never goes
  through the endpoint middleware stack, so an API's authentication
  middleware does not wrap it and the mount is reachable unauthenticated.
  Mounted Grape APIs are unaffected. Warn at compile time when a bare Rack
  app is mounted under configured authentication so the bypass isn't silent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1107 of 1228 branches covered (90.15%)

Branch coverage included in aggregate %.

3545 of 3659 relevant lines covered (96.88%)

972.48 hits per line