faraday 1.10.5 → 1.10.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: efc660709daf1320a9c5da2a957444e0bfab26fd8ee011f949b324c915083018
-  data.tar.gz: 2579fcc8e6470a92fd973b9472e1e746ef482000a6c013d04e8e607f9cd1b3e0
+  metadata.gz: 6c99ff059f5fdb0926b754a976809c5fe7db068c288a1ac5e0c3d70c26986f6f
+  data.tar.gz: 1ca17845876218b7d70805f8898da7fa1c520dc37030ccadbc3753d0f92866a0
 SHA512:
-  metadata.gz: 99a0d80605467ff74c10abc92fab4aba09972e71319e2f8112ae3b064b323be0f2c0b9e4a68090e4181daa68a8e7e1e58546a886e0a6b4570ef7c292bc8ceb02
-  data.tar.gz: 0c17e2e5471b0ceaa5b60912ecaa3396bdd720da239939956cdf67c71be8d2c379df8ec425db3af823a6fd26b3bc3228f84297dc4ff8a0d7aba7e039fb000354
+  metadata.gz: 7b5206b7e57f8ab2755de596c244807ed990067c240e23d18cf9a613a948edd0d83d131aa95eb79ec55a83787b0a360615ed0abf2cbc7a9ef27ddb45ae458150
+  data.tar.gz: d86797dcf2c0f154dbf8f4ad557665d8cd4f3b86940e15480cc107151fa2d7db8a8efd081dc1a9ae3e56303d7ecdba6fc373c380e5b5e0e32d6cb7c453a6e437

data/lib/faraday/encoders/nested_params_encoder.rb

@@ -100,6 +100,8 @@ module Faraday
 
     def decode_pair(key, value, context)
       subkeys = key.scan(SUBKEYS_REGEX)
+      validate_params_depth!(subkeys.length)
+
       subkeys.each_with_index do |subkey, i|
         is_array = subkey =~ /[\[\]]+\Z/
         subkey = $` if is_array
@@ -139,6 +141,12 @@ module Faraday
       is_array ? context << value : context[subkey] = value
     end
 
+    def validate_params_depth!(depth)
+      return unless @param_depth_limit && depth > @param_depth_limit
+
+      raise Faraday::Error, "exceeded nested parameter depth limit of #{@param_depth_limit}"
+    end
+
     # Internal: convert a nested hash with purely numeric keys into an array.
     # FIXME: this is not compatible with Rack::Utils.parse_nested_query
     # @!visibility private
@@ -161,7 +169,7 @@ module Faraday
   # for your requests.
   module NestedParamsEncoder
     class << self
-      attr_accessor :sort_params
+      attr_accessor :sort_params, :param_depth_limit
 
       extend Forwardable
       def_delegators :'Faraday::Utils', :escape, :unescape
@@ -169,6 +177,7 @@ module Faraday
 
     # Useful default for OAuth and caching.
     @sort_params = true
+    @param_depth_limit = 100
 
     extend EncodeMethods
     extend DecodeMethods

data/lib/faraday/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Faraday
-  VERSION = '1.10.5'
+  VERSION = '1.10.6'
 end

data/spec/faraday/connection_spec.rb

@@ -355,6 +355,19 @@ RSpec.describe Faraday::Connection do
       url = conn.build_url(nil, b: 2, c: 3)
       expect(url.to_s).to eq('http://sushi.com/nigiri?a=1&b=2&c=3')
     end
+
+    it 'raises a controlled error when URL query params exceed the nested depth limit' do
+      original_param_depth_limit = Faraday::NestedParamsEncoder.param_depth_limit
+      begin
+        Faraday::NestedParamsEncoder.param_depth_limit = 2
+        expect { conn.build_url('/nigiri?a[b][c]=1') }.to raise_error(
+          Faraday::Error,
+          'exceeded nested parameter depth limit of 2'
+        )
+      ensure
+        Faraday::NestedParamsEncoder.param_depth_limit = original_param_depth_limit
+      end
+    end
   end
 
   describe '#build_request' do

data/spec/faraday/params_encoders/nested_spec.rb

@@ -5,6 +5,15 @@ require 'rack/utils'
 RSpec.describe Faraday::NestedParamsEncoder do
   it_behaves_like 'a params encoder'
 
+  around do |example|
+    original_param_depth_limit = described_class.param_depth_limit
+    begin
+      example.run
+    ensure
+      described_class.param_depth_limit = original_param_depth_limit
+    end
+  end
+
   it 'decodes arrays' do
     query    = 'a[1]=one&a[2]=two&a[3]=three'
     expected = { 'a' => %w[one two three] }
@@ -59,6 +68,27 @@ RSpec.describe Faraday::NestedParamsEncoder do
     expect(subject.decode(query)).to eq(expected)
   end
 
+  it 'allows nested params within the configured depth limit' do
+    described_class.param_depth_limit = 3
+
+    expect(subject.decode('a[b][c]=1')).to eq({ 'a' => { 'b' => { 'c' => '1' } } })
+  end
+
+  it 'raises a controlled error when nested params exceed the depth limit' do
+    described_class.param_depth_limit = 2
+
+    expect { subject.decode('a[b][c]=1') }.to raise_error(
+      Faraday::Error,
+      'exceeded nested parameter depth limit of 2'
+    )
+  end
+
+  it 'allows disabling the nested params depth limit' do
+    described_class.param_depth_limit = nil
+
+    expect(subject.decode('a[b][c][d]=1')).to eq({ 'a' => { 'b' => { 'c' => { 'd' => '1' } } } })
+  end
+
   it 'encodes rack compat' do
     params   = { a: [{ one: '1', two: '2' }, '3', ''] }
     result   = Faraday::Utils.unescape(Faraday::NestedParamsEncoder.encode(params)).split('&')

data/spec/faraday_spec.rb

@@ -18,10 +18,14 @@ RSpec.describe Faraday do
     end
 
     it 'uses method_missing on Faraday if there is no proxyable method' do
-      expect { Faraday.this_method_does_not_exist }.to raise_error(
-        NoMethodError,
-        "undefined method `this_method_does_not_exist' for Faraday:Module"
-      )
+      expected_message =
+        if RUBY_VERSION >= '3.3'
+          "undefined method `this_method_does_not_exist' for module Faraday"
+        else
+          "undefined method `this_method_does_not_exist' for Faraday:Module"
+        end
+
+      expect { Faraday.this_method_does_not_exist }.to raise_error(NoMethodError, expected_message)
     end
 
     it 'proxied methods can be accessed' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: faraday
 version: !ruby/object:Gem::Version
-  version: 1.10.5
+  version: 1.10.6
 platform: ruby
 authors:
 - "@technoweenie"
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-12 00:00:00.000000000 Z
+date: 2026-06-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday-em_http
@@ -268,7 +268,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://lostisland.github.io/faraday
-  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v1.10.5
+  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v1.10.6
   source_code_uri: https://github.com/lostisland/faraday
   bug_tracker_uri: https://github.com/lostisland/faraday/issues
 post_install_message: