ruby-grape / grape / 29091554593 / 19

97%

master: 97%

Pull #2789

github

Harden mounted-app auth surface and error HTML escaping

Two security-relevant fixes surfaced by a review of Grape::API:

- Grape::Middleware::Error#rack_response only escaped the error message
  when the response content-type was exactly 'text/html', so a
  parameterized value such as 'text/html; charset=utf-8' skipped escaping
  and could reflect an unescaped message into an HTML response. Compare the
  media type only.

- A bare Rack app mounted with `mount` is called directly and never goes
  through the endpoint middleware stack, so an API's authentication
  middleware does not wrap it and the mount is reachable unauthenticated.
  Mounted Grape APIs are unaffected. Warn at compile time when a bare Rack
  app is mounted under configured authentication so the bypass isn't silent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1106 of 1226 branches covered (90.21%)

Branch coverage included in aggregate %.

3551 of 3666 relevant lines covered (96.86%)

970.73 hits per line