roda 3.107.0 → 3.109.0

data/lib/roda/plugins/hash_public_cache.rb

@@ -1,6 +1,5 @@
 # frozen-string-literal: true
 
-require 'json'
 require 'find'
 
 class Roda
@@ -29,6 +28,7 @@ class Roda
     #   load_hash_public_cache_file
     module HashPublicCache
       def self.load_dependencies(app, _cache_file, opts = OPTS)
+        app.plugin :_json
         app.plugin :hash_public, opts
       end
 
@@ -40,13 +40,15 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :hash_public_cache_file)
+
         # Load the hash public cache file, if it exists. This replaces the hash
         # public cache with the values from the file.
         def load_hash_public_cache_file
-          file = opts[:hash_public_cache_file]
+          file = hash_public_cache_file
           return unless File.file?(file)
 
-          cache = opts[:hash_public_cache] = (opts[:json_parser] || ::JSON.method(:parse)).call(::File.read(file))
+          cache = opts[:hash_public_cache] = json_parser.call(::File.read(file))
           cache.each_value(&:freeze)
           nil
         end
@@ -56,13 +58,13 @@ class Roda
         # If a block is given, it will only calculate the digest for the file
         # if the block returns truthy.
         def scan_hash_public_cache_dir
-          cache = opts[:hash_public_cache]
+          cache = hash_public_cache
 
           # Public root doesn't have trailing slash even if given, as
           # File.expand_path removes it.
-          root = opts[:public_root] + File::SEPARATOR
+          root = public_root + File::SEPARATOR
 
-          Find.find(opts[:public_root]) do |file|
+          Find.find(public_root) do |file|
             if File.file?(file)
               file = file.sub(root, '')
               next if cache[file]
@@ -80,7 +82,7 @@ class Roda
 
         # Write the current hash public cache to the cache file.
         def dump_hash_public_cache_file
-          File.write(opts[:hash_public_cache_file], (opts[:json_serializer] || :to_json.to_proc).call(opts[:hash_public_cache]))
+          File.write(hash_public_cache_file, json_serializer.call(hash_public_cache))
           nil
         end
       end

data/lib/roda/plugins/hash_routes.rb

@@ -191,7 +191,7 @@ class Roda
         def dispatch_from(namespace='', branch, &block)
           ns = @namespace
           if block
-            meth_hash = @roda.opts[:hash_routes_methods]
+            meth_hash = @roda.hash_routes_methods
             key = [:dispatch_from, namespace, branch].freeze
             meth = meth_hash[key] = @roda.define_roda_method(meth_hash[key] || "hash_routes_dispatch_from_#{namespace}_#{branch}", 1, &block)
             @roda.hash_branch(namespace, branch) do |r|
@@ -253,7 +253,7 @@ class Roda
         # Returns 404 for requests for the path with a different request method.
         def verb(verb, path, &block)
           path = path == true ? "" : "/#{path}"
-          meth_hash = @roda.opts[:hash_routes_methods]
+          meth_hash = @roda.hash_routes_methods
           key = [@namespace, path].freeze
           meth = meth_hash[key] = @roda.define_roda_method(meth_hash[key] || "hash_routes_#{@namespace}_#{path}", 0, &block)
           @roda.hash_path(@namespace, path) do |r|
@@ -265,9 +265,11 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :hash_routes_methods)
+
         # Freeze the hash_routes metadata when freezing the app.
         def freeze
-          opts[:hash_routes_methods].freeze
+          hash_routes_methods.freeze
           super
         end
 

data/lib/roda/plugins/heartbeat.rb

@@ -16,7 +16,11 @@ class Roda
     module Heartbeat
       # Set the heartbeat path to the given path.
       def self.configure(app, opts=OPTS)
-        app.opts[:heartbeat_path] = (opts[:path] || app.opts[:heartbeat_path] || "/heartbeat").dup.freeze
+        app.opts[:heartbeat_path] = (opts[:path] || app.heartbeat_path || "/heartbeat").dup.freeze
+      end
+
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :heartbeat_path)
       end
 
       module InstanceMethods
@@ -24,7 +28,7 @@ class Roda
 
         # If the request is for a heartbeat path, return the heartbeat response.
         def _roda_before_20__heartbeat
-          if env['PATH_INFO'] == opts[:heartbeat_path]
+          if env['PATH_INFO'] == self.class.heartbeat_path
             response = @_response
             response.status = 200
             response[RodaResponseHeaders::CONTENT_TYPE] = 'text/plain'

data/lib/roda/plugins/hmac_paths.rb

@@ -231,6 +231,12 @@ class Roda
         end
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :hmac_paths_secret)
+        RodaPlugins.opt_attr_reader(self, :hmac_paths_old_secret)
+        RodaPlugins.opt_attr_reader(self, :hmac_paths_namespace_session_key)
+      end
+
       module InstanceMethods
         # Return a path with an HMAC.  Designed to be used with r.hmac_path, to make sure
         # users can only request paths that they have been provided by the application
@@ -315,7 +321,7 @@ class Roda
         # using the secret given in the plugin, for the given root and options.
         # This always returns a hexidecimal string.
         def hmac_path_hmac_secret(root, opts=OPTS)
-          secret = opts[:secret] || self.opts[:hmac_paths_secret]
+          secret = opts[:secret] || self.class.hmac_paths_secret
 
           if namespace = hmac_path_namespace(opts)
             secret = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, secret, namespace)
@@ -326,7 +332,7 @@ class Roda
 
         # The default namespace to use for hmac_path, if a :namespace option is not provided.
         def hmac_path_default_namespace
-          if (key = opts[:hmac_paths_namespace_session_key]) && (value = session[key])
+          if (key = self.class.hmac_paths_namespace_session_key) && (value = session[key])
             value.to_s
           end
         end
@@ -346,43 +352,41 @@ class Roda
 
             if submitted_hmac.bytesize == 64
               on String do |flags|
-                if flags.bytesize >= 1
-                  if flags.include?('n') ^ !scope.hmac_path_namespace(opts).nil?
-                    # Namespace required and not provided, or provided and not required.
-                    # Bail early to avoid unnecessary HMAC calculation.
-                    @remaining_path = orig_path
-                    return
-                  end
+                if flags.include?('n') ^ !scope.hmac_path_namespace(opts).nil?
+                  # Namespace required and not provided, or provided and not required.
+                  # Bail early to avoid unnecessary HMAC calculation.
+                  @remaining_path = orig_path
+                  return
+                end
 
-                  if flags.include?('m')
-                    rpath = "#{env['REQUEST_METHOD'].to_s.upcase}:#{rpath}"
-                  end
+                if flags.include?('m')
+                  rpath = "#{env['REQUEST_METHOD'].to_s.upcase}:#{rpath}"
+                end
 
-                  if flags.include?('p')
-                    rpath = "#{rpath}?#{env["QUERY_STRING"]}"
-                  end
+                if flags.include?('p')
+                  rpath = "#{rpath}?#{env["QUERY_STRING"]}"
+                end
 
-                  if hmac_path_valid?(mpath, rpath, submitted_hmac, opts)
-                    if flags.include?('t')
-                      on Integer do |int|
-                        if int >= Time.now.to_i
-                          always(&block)
-                        else
-                          # Return from method without matching
-                          @remaining_path = orig_path
-                          return
-                        end
+                if hmac_path_valid?(mpath, rpath, submitted_hmac, opts)
+                  if flags.include?('t')
+                    on Integer do |int|
+                      if int >= Time.now.to_i
+                        always(&block)
+                      else
+                        # Return from method without matching
+                        @remaining_path = orig_path
+                        return
                       end
-                    else
-                      always(&block)
                     end
+                  else
+                    always(&block)
                   end
                 end
-
-                # Return from method without matching
-                @remaining_path = orig_path
-                return
               end
+
+              # Return from method without matching
+              @remaining_path = orig_path
+              return
             end
 
             # Return from method without matching
@@ -397,7 +401,7 @@ class Roda
         def hmac_path_valid?(root, path, hmac, opts=OPTS)
           if Rack::Utils.secure_compare(scope.hmac_path_hmac(root, path, opts), hmac)
             true
-          elsif old_secret = roda_class.opts[:hmac_paths_old_secret]
+          elsif old_secret = roda_class.hmac_paths_old_secret
             opts = opts.dup
             opts[:secret] = old_secret
             Rack::Utils.secure_compare(scope.hmac_path_hmac(root, path, opts), hmac)

data/lib/roda/plugins/hooks.rb

@@ -39,21 +39,24 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :after_hooks)
+        RodaPlugins.opt_attr_reader(self, :before_hooks)
+
         # Freeze the array of hook methods when freezing the app.
         def freeze
-          opts[:after_hooks].freeze
-          opts[:before_hooks].freeze
+          after_hooks.freeze
+          before_hooks.freeze
 
           super
         end
 
         # Add an after hook.
         def after(&block)
-          opts[:after_hooks] << define_roda_method("after_hook", 1, &block)
-          if opts[:after_hooks].length == 1
-            class_eval("alias _roda_after_80__hooks #{opts[:after_hooks].first}", __FILE__, __LINE__)
+          after_hooks << define_roda_method("after_hook", 1, &block)
+          if after_hooks.length == 1
+            class_eval("alias _roda_after_80__hooks #{after_hooks.first}", __FILE__, __LINE__)
           else
-            class_eval("def _roda_after_80__hooks(res) #{opts[:after_hooks].map{|m| "#{m}(res)"}.join(';')} end", __FILE__, __LINE__)
+            class_eval("def _roda_after_80__hooks(res) #{after_hooks.map{|m| "#{m}(res)"}.join(';')} end", __FILE__, __LINE__)
           end
           private :_roda_after_80__hooks
           def_roda_after
@@ -62,11 +65,11 @@ class Roda
 
         # Add a before hook.
         def before(&block)
-          opts[:before_hooks].unshift(define_roda_method("before_hook", 0, &block))
-          if opts[:before_hooks].length == 1
-            class_eval("alias _roda_before_10__hooks #{opts[:before_hooks].first}", __FILE__, __LINE__)
+          before_hooks.unshift(define_roda_method("before_hook", 0, &block))
+          if before_hooks.length == 1
+            class_eval("alias _roda_before_10__hooks #{before_hooks.first}", __FILE__, __LINE__)
           else
-            class_eval("def _roda_before_10__hooks; #{opts[:before_hooks].join(';')} end", __FILE__, __LINE__)
+            class_eval("def _roda_before_10__hooks; #{before_hooks.join(';')} end", __FILE__, __LINE__)
           end
           private :_roda_before_10__hooks
           def_roda_before

data/lib/roda/plugins/host_authorization.rb

@@ -101,6 +101,11 @@ class Roda
         end
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :host_authorization_host)
+        RodaPlugins.opt_attr_reader(self, :host_authorization_check_forwarded, name: :host_authorization_check_forwarded?)
+      end
+
       module InstanceMethods
         # Check whether the host is authorized.  If not authorized, return a response
         # immediately based on the plugin block.
@@ -108,7 +113,7 @@ class Roda
           r = @_request
           return if host_authorized?(_convert_host_for_authorization(r.env["HTTP_HOST"].to_s.dup))
 
-          if opts[:host_authorization_check_forwarded] && (host = r.env["HTTP_X_FORWARDED_HOST"])
+          if self.class.host_authorization_check_forwarded? && (host = r.env["HTTP_X_FORWARDED_HOST"])
             if i = host.rindex(',')
               host = host[i+1, 10000000].to_s
             end
@@ -133,7 +138,7 @@ class Roda
         end
 
         # Whether the host given is one of the authorized hosts for this application.
-        def host_authorized?(host, authorized_host = opts[:host_authorization_host])
+        def host_authorized?(host, authorized_host = self.class.host_authorization_host)
           case authorized_host
           when Array
             authorized_host.any?{|auth_host| host_authorized?(host, auth_host)}

data/lib/roda/plugins/host_routing.rb

@@ -68,8 +68,29 @@ class Roda
     #     end
     #   end
     #
-    # This plugin uses the host method on the request to get the hostname (this method
-    # is defined by Rack).
+    # This plugin uses the +host+ method on the request to get the hostname (this method
+    # is defined by Rack). Note that as of Rack 3.2, Rack's default approach to determine
+    # the hostname is insecure in many cases, since:
+    #
+    # * It will use a forwarded header instead of the +host+ header by default if the
+    #   request was from a trusted proxy.
+    # * Rack trust proxies from any private IP address range by default
+    #   (this can be disabled using <tt>Rack::Request.ip_filter=</tt>).
+    # * Rack supports both +forwarded+ and <tt>x-forwarded-host</tt> headers, will check
+    #   both by default, and the order of checking depends on Rack's configuration
+    #   (this can be configured using <tt>Rack::Request.forwarded_priority</tt>).
+    # * If the application can be reached via an arbitrary +host+ header, the attacker
+    #   has full control over the <tt>Rack::Request#host</tt> value even when forwarded
+    #   host usage is disabled.
+    #
+    # You should configure Rack appropriately for your deployment, not allowing the use
+    # of forwarded information unless your deployment is using a reverse proxy, and only
+    # allowing the specific forwarded header set by the expected reverse proxy if a
+    # reverse proxy is used. Rack 3.3 should include more control in this area,
+    # and Rack 4 should ship with more secure defaults in regard to forwarding headers.
+    #
+    # It is recommended to use the host_authorization plugin to check that the requested
+    # host is allowed when using this plugin.
     module HostRouting
       REQUEST_INSTANCE_VARIABLES = [:@_host_routing_host].freeze
 
@@ -140,7 +161,7 @@ class Roda
         # Treat all given hostnames as routing to the give host.
         def to(host, *hostnames)
           hostnames.each do |hostname|
-            @host_hash[hostname] = host
+            @host_hash[hostname.downcase.freeze] = host
           end
         end
 
@@ -155,6 +176,11 @@ class Roda
       end
       private_constant :DSL
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :host_routing_hash)
+        RodaPlugins.opt_attr_reader(self, :host_routing_default_host)
+      end
+
       module InstanceMethods
         # Handle case where plugin is used without providing a block to
         # +hosts.default+.  This returns nil, ensuring that the hostname
@@ -180,11 +206,15 @@ class Roda
         # * The return value of the +hosts.default+ block, if given
         # * The default value provided in the +hosts.default+ call
         def _get_host_routing_host
-          host = self.host || ""
+          if host = self.host
+            host = host.downcase
+          else
+            host = ""
+          end
 
-          roda_class.opts[:host_routing_hash][host] ||
+          roda_class.host_routing_hash[host] ||
             scope._host_routing_default(host) ||
-            roda_class.opts[:host_routing_default_host]
+            roda_class.host_routing_default_host
         end
       end
     end

data/lib/roda/plugins/invalid_request_body.rb

@@ -37,13 +37,25 @@ class Roda
     #     # To treat the exception raised as a submitted parameter
     #     {body_error: exception}
     #   end
+    #
+    # You can use the +rescue_classes+ argument when loading the plugin to only rescue
+    # specific exception classes:
+    #
+    #   plugin :invalid_request_body, :empty_hash, rescue_classes: Rack::BadRequest
+    #
+    # However, this can be risky, because there have been many cases in the past where
+    # Rack can rescue classes such as +ArgumentError+ or +NoMethodError+ when parsing
+    # invalid request bodies. The default for +rescue_classes+ is +StandardError+.
     module InvalidRequestBody
       # Exception class raised for invalid request bodies.
       Error = Class.new(RodaError)
 
       # Set the action to use (:empty_400, :empty_hash, :raise) for invalid request bodies,
-      # or use a block for custom behavior.
-      def self.configure(app, action=nil, &block)
+      # or use a block for custom behavior. The rescue_classes argument is an exception
+      # class or array of exception classes to rescue.
+      def self.configure(app, action=nil, rescue_classes: StandardError, &block)
+        app.opts[:invalid_response_body_rescue_classes] = Array(rescue_classes).dup.freeze
+
         if action
           if block
             raise RodaError, "cannot provide both block and action when loading invalid_request_body plugin"
@@ -56,7 +68,7 @@ class Roda
 
           app::RodaRequest.send(:alias_method, :handle_invalid_request_body, method)
         elsif block
-          app::RodaRequest.class_eval do
+          app::RodaRequest.class_exec do
             define_method(:handle_invalid_request_body, &block)
             alias handle_invalid_request_body handle_invalid_request_body
           end
@@ -67,12 +79,18 @@ class Roda
         app::RodaRequest.send(:private, :handle_invalid_request_body)
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :invalid_response_body_rescue_classes)
+      end
+
       module RequestMethods
         # Handle invalid request bodies as configured if the default behavior
         # raises an exception.
         def POST
           super
-        rescue => e 
+        rescue RodaError
+          raise
+        rescue *roda_class.invalid_response_body_rescue_classes => e 
           handle_invalid_request_body(e)
         end
 

data/lib/roda/plugins/ip_from_header.rb

@@ -20,11 +20,15 @@ class Roda
         app.opts[:ip_from_header_env_key] = "HTTP_#{header.upcase.tr('-', '_')}".freeze
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :ip_from_header_env_key)
+      end
+
       module RequestMethods
         # Return the IP address continained in the configured header, if present.
         # Fallback to the default behavior if not present.
         def ip
-          @env[roda_class.opts[:ip_from_header_env_key]] || super
+          @env[roda_class.ip_from_header_env_key] || super
         end
       end
     end

data/lib/roda/plugins/json.rb

@@ -1,7 +1,5 @@
 # frozen-string-literal: true
 
-require 'json'
-
 class Roda
   module RodaPlugins
     # The json plugin allows match blocks to return
@@ -57,6 +55,7 @@ class Roda
     # not support treating String, FalseClass, or NilClass values as JSON.
     module Json
       def self.load_dependencies(app, opts=OPTS)
+        app.plugin :_json
         app.plugin :custom_block_results
       end
 
@@ -69,10 +68,10 @@ class Roda
         classes.uniq!
         classes.freeze
         classes.each do |klass|
-          app.opts[:custom_block_results][klass] = :handle_json_block_result
+          app.custom_block_results[klass] = :handle_json_block_result
         end
 
-        app.opts[:json_result_serializer] = opts[:serializer] || app.opts[:json_result_serializer] || app.opts[:json_serializer] || :to_json.to_proc
+        app.opts[:json_result_serializer] = opts[:serializer] || app.json_result_serializer || app.json_serializer
 
         app.opts[:json_result_include_request] = opts[:include_request] if opts.has_key?(:include_request)
 
@@ -80,6 +79,10 @@ class Roda
       end
 
       module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :json_result_serializer)
+        RodaPlugins.opt_attr_reader(self, :json_result_include_request, name: :json_result_include_request?)
+        RodaPlugins.opt_attr_reader(self, :json_result_content_type)
+
         # The classes that should be automatically converted to json
         def json_result_classes
           # RODA4: remove, only used by previous implementation.
@@ -91,7 +94,7 @@ class Roda
         # Handle a result for one of the registered JSON result classes
         # by converting the result to JSON.
         def handle_json_block_result(result)
-          @_response[RodaResponseHeaders::CONTENT_TYPE] ||= opts[:json_result_content_type]
+          @_response[RodaResponseHeaders::CONTENT_TYPE] ||= self.class.json_result_content_type
           @_request.send(:convert_to_json, result)
         end
       end
@@ -102,10 +105,9 @@ class Roda
         # Convert the given object to JSON.  Uses to_json by default,
         # but can use a custom serializer passed to the plugin.
         def convert_to_json(result)
-          opts = roda_class.opts
-          serializer = opts[:json_result_serializer]
+          serializer = roda_class.json_result_serializer
 
-          if opts[:json_result_include_request]
+          if roda_class.json_result_include_request?
             serializer.call(result, self)
           else
             serializer.call(result)

data/lib/roda/plugins/json_parser.rb

@@ -1,7 +1,5 @@
 # frozen-string-literal: true
 
-require 'json'
-
 class Roda
   module RodaPlugins
     # The json_parser plugin parses request bodies in JSON format
@@ -17,7 +15,23 @@ class Roda
     module JsonParser
       DEFAULT_ERROR_HANDLER = proc{|r| r.halt [400, {}, []]}
 
+      # simplecov:disable
+      MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
+      # simplecov:enable
+      private_constant :MATCH_METHOD
+
+      def self.load_dependencies(app, opts=OPTS)
+        app.plugin :_json
+      end
+
       # Handle options for the json_parser plugin:
+      # :content_type_regexp :: A regexp used to determine if the request's
+      #                         content type is JSON. For backwards compatibility,
+      #                         uses the insecure /json/ if not provided. Warns
+      #                         if this option is not provided. The recommended
+      #                         value to use is /\Aapplication\/json\b/i or
+      #                         /\Aapplication\/(?:vnd\.api\+)?json\b/i. Roda 4
+      #                         will default to the latter.
       # :error_handler :: A proc to call if an exception is raised when
       #                   parsing a JSON request body.  The proc is called
       #                   with the request object, and should probably call
@@ -34,9 +48,16 @@ class Roda
       #          :always will wrap all values, and a value of :unless_hash will
       #          only wrap values that are not already hashes.
       def self.configure(app, opts=OPTS)
-        app.opts[:json_parser_error_handler] = opts[:error_handler] || app.opts[:json_parser_error_handler] || DEFAULT_ERROR_HANDLER
-        app.opts[:json_parser_parser] = opts[:parser] || app.opts[:json_parser_parser] || app.opts[:json_parser] || JSON.method(:parse)
+        app.opts[:json_parser_error_handler] = opts[:error_handler] || app.json_parser_error_handler || DEFAULT_ERROR_HANDLER
+        app.opts[:json_parser_parser] = opts[:parser] || app.json_parser_parser || app.json_parser
         app.opts[:json_parser_include_request] = opts[:include_request] if opts.has_key?(:include_request)
+        app.opts[:json_parser_content_type_regexp] = opts[:content_type_regexp] || app.json_parser_content_type_regexp
+
+        unless app.json_parser_content_type_regexp
+          # RODA4: Switch to /\Aapplication\/(?:vnd\.api\+)?json\b/i by default
+          RodaPlugins.warn(':content_type_regexp option not provided to json_parser plugin, using /json/ for backwards compatibility, which may be insecure, using /\Aapplication\/json\b/i or /\Aapplication\/(?:vnd\.api\+)?json\b/i is recommended')
+          app.opts[:json_parser_content_type_regexp] = /json/
+        end
 
         case opts[:wrap]
         when :unless_hash, :always
@@ -48,6 +69,14 @@ class Roda
         end
       end
 
+      module ClassMethods
+        RodaPlugins.opt_attr_reader(self, :json_parser_error_handler)
+        RodaPlugins.opt_attr_reader(self, :json_parser_parser)
+        RodaPlugins.opt_attr_reader(self, :json_parser_include_request, name: :json_parser_include_request?)
+        RodaPlugins.opt_attr_reader(self, :json_parser_content_type_regexp)
+        RodaPlugins.opt_attr_reader(self, :json_parser_wrap)
+      end
+
       module RequestMethods
         # If the Content-Type header in the request includes "json",
         # parse the request body as JSON.  Ignore an empty request body.
@@ -57,7 +86,7 @@ class Roda
             return post_params
           end
 
-          unless (input = env["rack.input"]) && (content_type = self.content_type) && content_type.include?('json')
+          unless (input = env["rack.input"]) && (content_type = self.content_type) && roda_class.json_parser_content_type_regexp.send(MATCH_METHOD, content_type)
             return super
           end
 
@@ -66,10 +95,10 @@ class Roda
           begin
             json_params = parse_json(str)
           rescue
-            roda_class.opts[:json_parser_error_handler].call(self)
+            roda_class.json_parser_error_handler.call(self)
           end
 
-          wrap = roda_class.opts[:json_parser_wrap]
+          wrap = roda_class.json_parser_wrap
           if wrap == :always || (wrap == :unless_hash && !json_params.is_a?(Hash))
             json_params = {"_json"=>json_params}
           end
@@ -80,11 +109,14 @@ class Roda
         private
 
         def parse_json(str)
-          args = [str]
-          args << self if roda_class.opts[:json_parser_include_request]
-          roda_class.opts[:json_parser_parser].call(*args)
-        end
+          parser = roda_class.json_parser_parser
 
+          if roda_class.json_parser_include_request?
+            parser.call(str, self)
+          else
+            parser.call(str)
+          end
+        end
         
         # Rack 3 dropped requirement that input be rewindable
         if Rack.release >= '3'