ruby-grape / grape / 30490575051 / 31

97%

master: 97%

push

github

Tag path params as UTF-8 instead of leaving them binary

Mustermann decodes path captures out of PATH_INFO, which Rack hands over
tagged ASCII-8BIT, and nothing re-tagged the result. Query and body params
arrive UTF-8 because Rack tags those itself, so the same value reached the
endpoint with a different encoding depending on where it came from.

That made an API's declarations disagree with themselves — a binary string
never equals the UTF-8 literal it was written as:

    params { requires :id, type: String, values: ['café'] }

    GET /?id=café   ->  200
    GET /café       ->  400 "id does not have a valid value"

The same held for same_as, except_values and any comparison an endpoint made
against a non-ASCII literal. It also leaked into serialization: a non-ASCII
path param rendered into a JSON response drew an encoding warning from the
json gem, which that gem says will become an error in json 3.0.

Re-tag in Route#params_for, the single funnel for path-extracted values, the
way Rails does after unescaping a path. Only the encoding changes: the bytes
are untouched, so an invalid sequence stays invalid and is still caught
downstream instead of being silently scrubbed into something the client never
sent. Unnamed splats capture into an Array, so those are walked too.

No extra allocations — the captures are freshly built and unfrozen, so the
re-tag happens in place.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

170 of 1289 branches covered (13.19%)

Branch coverage included in aggregate %.

2295 of 3876 relevant lines covered (59.21%)

0.98 hits per line