ruby-grape / grape / 29200085335 / 16

97%

master: 97%

push

github

Don't mutate router maps at request time (#2790)

Grape::Router built @map and @optimized_map as auto-vivifying hashes
(Hash.new { |h, k| h[k] = ... }). compile! only fills keys for HTTP
methods that have routes, but at request time #match? and #rotation look
the maps up by the request's method, so any method with no routes inserted
a key into the shared hashes. The router is frozen only shallowly, so the
inner hashes stayed mutable.

That is a data race on runtimes without a GVL (JRuby, TruffleRuby), where
concurrent Hash#[]= corrupts the hash, and unbounded growth everywhere:
each distinct method string becomes a permanent key, so a client sending
arbitrary methods grows the maps without limit.

Use plain hashes, create the array explicitly on append, freeze both maps
after compile!, and read missing keys without inserting (#match? via safe
navigation, #rotation via &.each). Requests with an unrouted method still
resolve to 404/405 exactly as before.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

1104 of 1222 branches covered (90.34%)

Branch coverage included in aggregate %.

3544 of 3659 relevant lines covered (96.86%)

964.31 hits per line