ruby-grape / grape / 29200085335 / 25

97%

master: 97%

push

github

Don't mutate router maps at request time (#2790)

Grape::Router built @map and @optimized_map as auto-vivifying hashes
(Hash.new { |h, k| h[k] = ... }). compile! only fills keys for HTTP
methods that have routes, but at request time #match? and #rotation look
the maps up by the request's method, so any method with no routes inserted
a key into the shared hashes. The router is frozen only shallowly, so the
inner hashes stayed mutable.

That is a data race on runtimes without a GVL (JRuby, TruffleRuby), where
concurrent Hash#[]= corrupts the hash, and unbounded growth everywhere:
each distinct method string becomes a permanent key, so a client sending
arbitrary methods grows the maps without limit.

Use plain hashes, create the array explicitly on append, freeze both maps
after compile!, and read missing keys without inserting (#match? via safe
navigation, #rotation via &.each). Requests with an unrouted method still
resolve to 404/405 exactly as before.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

302 of 1222 branches covered (24.71%)

Branch coverage included in aggregate %.

2536 of 3655 relevant lines covered (69.38%)

5.71 hits per line