1
95%
master: 95%

Ran 28 Jul 2026 05:29PM UTC

Files 48

Run time 2s

Badge

Embed ▾

Committed 28 Jul 2026 05:27PM UTC coverage: 91.349% (-0.03%) from 91.38%

Job # 30382952146.1

Build Type

push

github

Committed by

gregschmit

Commit Message

Reject nested-hash filter params; document associations_limit_max.

Filter backends now guard against query params whose values are nested
hashes (e.g. `?field[evil]=x`, which Rack parses into a
HashWithIndifferentAccess). Previously these flowed into AR bind values
and raised `TypeError (can't quote ...)`, or broke `String#split` /
`sanitize_sql_like`. Adds a `_safe_query_value?` helper on BaseFilter,
applied in QueryFilter and OrderingFilter, and a String check in
SearchFilter. Includes regression tests for each backend.

Also documents `native_serializer_associations_limit_max` in the
serializers and performance guides: default `5` cap, clamp-to-max
semantics, and how to raise the ceiling or disable the query param.

Coverage Stats

2376 of 2601 relevant lines covered (91.35%)

157.7 hits per line

gregschmit / rails-rest-framework / 30382952146 / 1
95%
master: 95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 30382952146.1

gregschmit / rails-rest-framework / 30382952146 / 1 95% master: 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 30382952146.1

gregschmit / rails-rest-framework / 30382952146 / 1
95%
master: 95%

README BADGES
x