ruby-grape / grape / 30170997140 / 8

97%

master: 97%

push

github

Add fuzz test for adversarial nesting depth

Several validation-runtime paths recurse on the shape of incoming params:
AttributesIterator#do_each recurses into nested arrays, and coercion/oneof
walk nested hashes and arrays. A deeply nested payload is a resource-
exhaustion surface.

This fuzzes random shapes (nested arrays, hashes, mixed) and depths across
every recursive path — Array/Hash scopes, type: JSON, oneof, Set coercion —
sending real request bytes, and asserts the request is never answered with a
5xx / uncaught exception. It documents that the upstream parsers
(Rack param_depth_limit, JSON max_nesting) cap depth well below Grape's own
recursion ceiling, so the reachable surface degrades to a controlled 4xx.

The generator is seeded from RSpec's seed, so a failure reproduces with
--seed <n> and prints the offending endpoint/shape/depth.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

158 of 1228 branches covered (12.87%)

Branch coverage included in aggregate %.

2277 of 3812 relevant lines covered (59.73%)

1.01 hits per line