Reject params nested deeper than the array scope declares

[ericproulx]

Summary

AttributesIterator#do_each recursed into any element that was an Array. That recursion is genuinely required when the declaration nests array scopes — map_params adds one level of nesting per element-iterating scope on the chain, so the params for the inner scope really are an array of arrays — but nothing compared the incoming depth against the declared one.

A request could therefore wrap its elements in extra arrays and have them silently unwrapped:

params do
  requires :lines, type: Array do
    requires :book_id, type: String
    requires :qty, type: Integer
  end
end
post(:orders) { params[:lines].sum { |l| l[:qty] } }

body	before	after
{"lines":[{"book_id":"x","qty":1}]}	201	201
{"lines":[[{"book_id":"x","qty":1}]]}	201, then TypeError in the endpoint	400
{"lines":[[[{"book_id":"x","qty":1}]]]}	201, then TypeError	400
{"lines":[[]]}	201, then TypeError	400

Validation passed and params[:lines] / declared handed the endpoint [[{...}]], so any ordinary body assuming the declared shape died with TypeError: no implicit conversion of Symbol into Integer — a 500 on malformed input. The same held for an array scope declared inside a hash.

type: Array[JSON] error indices

The scope predicate this needs turned out to be the same one that decides whether an element index is meaningful, and it was wrong for Array[JSON] — which iterates elements just as much, but evaluates to the Array instance [JSON] rather than the Array class, so an == Array test quietly excluded it. Every element then reported under the same bracket-less name:

body, against requires :docs, type: Array[JSON] do requires :name end	before	after
2nd of 3 elements bad	docs[name] is missing	docs[1][name] is missing
two elements bad	docs[name] is missing (one message)	docs[0][name] is missing, docs[1][name] is missing

So a client could not tell which element failed, or even how many did — the errors deduped. type: Array do already reported correctly; Array[JSON] now matches it.

Approach

Each scope records at definition time how many element-iterating scopes sit on its chain (ParamsScope#array_depth, built on a new #iterates_elements?). The iterator descends that many levels, less the one Array.wrap already consumes in #each, and yields anything deeper as-is. The attribute validators then see a non-hash and fail it exactly as they do for any other unexpected element type (hash_like? is respond_to?(:key?), which an Array is not), so these requests get the 400 they always should have — no new error path.

Declared nesting is unaffected: requires :a, type: Array do requires :b, type: Array do ... end end still descends both levels and still reports a[0][b][0][c] is missing.

Backward compatibility

Requests previously accepted through the silent unwrap are now rejected with 400. In practice they could not be served — the endpoint received a shape it never declared — so this converts a 500 into the correct 4xx rather than removing working behaviour.

One error-message change: Array[JSON] failures now carry the element index. coerce_validator_spec.rb's "accepts Array[JSON] shorthand" asserted the bracket-less form and is updated; a bare object is coerced into a one-element array, so it now reports splines[0][x] consistently with an explicit array.

Neither is a regression — both behaviours are present in 3.3.4 and earlier.

Test plan

• Five examples in params_scope_spec.rb covering the flat, hash-wrapped and declared-nested cases, plus three in coerce_validator_spec.rb for Array[JSON] indices and multi-element reporting; verified they fail without the lib/ change.
• Full RSpec suite passes locally (2554 examples, 0 failures).
• RuboCop clean.
• CI green.

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run