grape 0.2.5 → 0.2.6

data/CHANGELOG.markdown

@@ -1,3 +1,9 @@
+0.2.6 (01/11/2013)
+==================
+
+* Fix: support content-type with character set when parsing POST and PUT input - [@dblock](http://github.com/dblock).
+* Fix: CVE-2013-0175, multi_xml parse vulnerability, require multi_xml 0.5.2 - [@dblock](http://github.com/dblock).
+
 0.2.5 (01/10/2013)
 ==================
 

data/README.markdown

@@ -10,11 +10,6 @@ content negotiation, versioning and much more.
 
 [![Build Status](https://travis-ci.org/intridea/grape.png?branch=master)](http://travis-ci.org/intridea/grape)
 
-## Stable Release
-
-You're reading the documentation for the next release of Grape, which should be 0.2.5.
-The current stable release is [0.2.4](https://github.com/intridea/grape/blob/v0.2.4/README.markdown).
-
 ## Project Tracking
 
 * [Grape Google Group](http://groups.google.com/group/ruby-grape)

data/grape.gemspec

@@ -20,7 +20,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'activesupport'
   # s.add_runtime_dependency 'rack-jsonp'
   s.add_runtime_dependency 'multi_json', '>= 1.3.2'
-  s.add_runtime_dependency 'multi_xml'
+  s.add_runtime_dependency 'multi_xml', '>= 0.5.2'
   s.add_runtime_dependency 'hashie', '~> 1.2'
   s.add_runtime_dependency 'virtus'
   s.add_runtime_dependency 'builder'

data/lib/grape/middleware/formatter.rb

@@ -34,11 +34,10 @@ module Grape
       private
 
         def read_body_input
-          request_method = request.request_method.to_s.upcase
-          if [ 'POST', 'PUT' ].include?(request_method) && (! request.form_data?) && (request.content_length.to_i > 0)
-            if env['rack.input'] && (body = env['rack.input'].read).strip.length > 0
+          if (request.post? || request.put?) && (! request.form_data?) && (! request.parseable_data?) && (request.content_length.to_i > 0)
+            if env['rack.input'] && (body = env['rack.input'].read).length > 0
               begin
-                fmt = mime_types[format_from_content_type]
+                fmt = mime_types[request.media_type] if request.media_type
                 if content_type_for(fmt)
                   parser = Grape::Parser::Base.parser_for fmt, options
                   unless parser.nil?
@@ -46,8 +45,8 @@ module Grape
                       body = parser.call body, env
                       env['rack.request.form_hash'] = env['rack.request.form_hash'] ? env['rack.request.form_hash'].merge(body) : body
                       env['rack.request.form_input'] = env['rack.input']
-                    rescue
-                      # It's possible that it's just regular POST content -- just back off
+                    rescue Exception => e
+                      throw :error, :status => 400, :message => e.message
                     end
                   end
                 else
@@ -69,13 +68,6 @@ module Grape
           end
         end
 
-        def format_from_content_type
-          fmt = env['CONTENT_TYPE']
-          # avoid symbol memory leak on an unknown format
-          return fmt.to_sym if content_type_for(fmt)
-          fmt
-        end
-
         def format_from_extension
           parts = request.path.split('.')
 

data/lib/grape/version.rb

@@ -1,3 +1,3 @@
 module Grape
-  VERSION = '0.2.5'
+  VERSION = '0.2.6'
 end

data/spec/grape/api_spec.rb

@@ -1088,10 +1088,12 @@ describe Grape::API do
           params[:simple]
         end
       end
-      it 'uses parser' do
-        put '/simple', "simple", "CONTENT_TYPE" => "text/custom"
-        last_response.status.should == 200
-        last_response.body.should eql "elpmis"
+      [ "text/custom", "text/custom; charset=UTF-8" ].each do |content_type|
+        it "uses parser for #{content_type}" do
+          put '/simple', "simple", "CONTENT_TYPE" => content_type
+          last_response.status.should == 200
+          last_response.body.should eql "elpmis"
+        end
       end
     end
     context 'custom parser class' do
@@ -1114,6 +1116,16 @@ describe Grape::API do
         last_response.body.should eql "elpmis"
       end
     end
+    context "muti_xml" do
+      it "doesn't parse yaml" do
+        subject.put :yaml do
+          params[:tag]
+        end
+        put '/yaml', '<tag type="symbol">a123</tag>', "CONTENT_TYPE" => "application/xml"
+        last_response.status.should == 400
+        last_response.body.should eql 'Disallowed type attribute: "symbol"'
+      end
+    end
   end
 
   describe '.default_error_status' do

data/spec/grape/middleware/formatter_spec.rb

@@ -67,7 +67,7 @@ describe Grape::Middleware::Formatter do
     end
   end
 
-  context 'Accept header detection' do
+  context 'accept header detection' do
     it 'detects from the Accept header' do
       subject.call({'PATH_INFO' => '/info', 'HTTP_ACCEPT' => 'application/xml'})
       subject.env['api.format'].should == :xml
@@ -106,7 +106,7 @@ describe Grape::Middleware::Formatter do
     end
   end
 
-  context 'Content-type' do
+  context 'content-type' do
     it 'is set for json' do
       _, headers, _ = subject.call({'PATH_INFO' => '/info.json'})
       headers['Content-type'].should == 'application/json'
@@ -127,7 +127,7 @@ describe Grape::Middleware::Formatter do
     end
   end
 
-  context 'Format' do
+  context 'format' do
     it 'uses custom formatter' do
       subject.options[:content_types] = {}
       subject.options[:content_types][:custom] = "don't care"
@@ -147,18 +147,20 @@ describe Grape::Middleware::Formatter do
     end
   end
 
-  context 'Input' do
-    it 'parses the body from a POST/PUT and put the contents into rack.request.form_hash' do
-      io = StringIO.new('{"is_boolean":true,"string":"thing"}')
-      subject.call({
-        'PATH_INFO' => '/info',
-        'REQUEST_METHOD' => 'POST',
-        'CONTENT_TYPE' => 'application/json',
-        'rack.input' => io,
-        'CONTENT_LENGTH' => io.length
-      })
-      subject.env['rack.request.form_hash']['is_boolean'].should be_true
-      subject.env['rack.request.form_hash']['string'].should == 'thing'
+  context 'input' do
+    [ "application/json", "application/json; charset=utf-8" ].each do |content_type|
+      it 'parses the body from a POST/PUT and put the contents into rack.request.form_hash for #{content_type}' do
+        io = StringIO.new('{"is_boolean":true,"string":"thing"}')
+        subject.call({
+          'PATH_INFO' => '/info',
+          'REQUEST_METHOD' => 'POST',
+          'CONTENT_TYPE' => content_type,
+          'rack.input' => io,
+          'CONTENT_LENGTH' => io.length
+        })
+        subject.env['rack.request.form_hash']['is_boolean'].should be_true
+        subject.env['rack.request.form_hash']['string'].should == 'thing'
+      end
     end
     it 'parses the body from an xml POST/PUT and put the contents into rack.request.from_hash' do
       io = StringIO.new('<thing><name>Test</name></thing>')
@@ -171,16 +173,18 @@ describe Grape::Middleware::Formatter do
       })
       subject.env['rack.request.form_hash']['thing']['name'].should == 'Test'
     end
-    it 'is able to fail gracefully if the body is regular POST content' do
-      io = StringIO.new('name=Other+Test+Thing')
-      subject.call({
-        'PATH_INFO' => '/info',
-        'REQUEST_METHOD' => 'POST',
-        'CONTENT_TYPE' => 'application/json',
-        'rack.input' => io,
-        'CONTENT_LENGTH' => io.length
-      })
-      subject.env['rack.request.form_hash'].should be_nil
+    [ Rack::Request::FORM_DATA_MEDIA_TYPES, Rack::Request::PARSEABLE_DATA_MEDIA_TYPES ].flatten.each do |content_type|
+      it "ignores #{content_type}" do
+        io = StringIO.new('name=Other+Test+Thing')
+        subject.call({
+          'PATH_INFO' => '/info',
+          'REQUEST_METHOD' => 'POST',
+          'CONTENT_TYPE' => content_type,
+          'rack.input' => io,
+          'CONTENT_LENGTH' => io.length
+        })
+        subject.env['rack.request.form_hash'].should be_nil
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: grape
 version: !ruby/object:Gem::Version
-  version: 0.2.5
+  version: 0.2.6
   prerelease: 
 platform: ruby
 authors:
@@ -98,7 +98,7 @@ dependencies:
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.5.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -106,7 +106,7 @@ dependencies:
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.5.2
 - !ruby/object:Gem::Dependency
   name: hashie
   requirement: !ruby/object:Gem::Requirement
@@ -348,7 +348,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3430639806354577699
+      hash: 1249607937311024438
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -357,7 +357,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3430639806354577699
+      hash: 1249607937311024438
 requirements: []
 rubyforge_project: grape
 rubygems_version: 1.8.24