ruby-grape / grape / 29092242866 / 12

97%

master: 97%

Pull #2790

github

Don't mutate router maps at request time

Grape::Router built @map and @optimized_map as auto-vivifying hashes
(Hash.new { |h, k| h[k] = ... }). compile! only fills keys for HTTP
methods that have routes, but at request time #match? and #rotation look
the maps up by the request's method, so any method with no routes inserted
a key into the shared hashes. The router is frozen only shallowly, so the
inner hashes stayed mutable.

That is a data race on runtimes without a GVL (JRuby, TruffleRuby), where
concurrent Hash#[]= corrupts the hash, and unbounded growth everywhere:
each distinct method string becomes a permanent key, so a client sending
arbitrary methods grows the maps without limit.

Use plain hashes, create the array explicitly on append, freeze both maps
after compile!, and read missing keys without inserting (#match? via safe
navigation, #rotation via &.each). Requests with an unrouted method still
resolve to 404/405 exactly as before.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

394 of 1224 branches covered (32.19%)

Branch coverage included in aggregate %.

2651 of 3657 relevant lines covered (72.49%)

7.76 hits per line