Reject params nested deeper than the array scope declares

[ericproulx]

Summary

AttributesIterator#do_each recursed into any element that was an Array. That recursion is genuinely required when the declaration nests array scopes — map_params adds one level of nesting per Array-typed scope on the chain, so the params for the inner scope really are an array of arrays — but nothing compared the incoming depth against the declared one.

A request could therefore wrap its elements in extra arrays and have them silently unwrapped:

params do
  requires :lines, type: Array do
    requires :book_id, type: String
    requires :qty, type: Integer
  end
end
post(:orders) { params[:lines].sum { |l| l[:qty] } }

body	before	after
{"lines":[{"book_id":"x","qty":1}]}	201	201
{"lines":[[{"book_id":"x","qty":1}]]}	201, then TypeError in the endpoint	400
{"lines":[[[{"book_id":"x","qty":1}]]]}	201, then TypeError	400
{"lines":[[]]}	201, then TypeError	400

Validation passed and params[:lines] / declared handed the endpoint [[{...}]], so any ordinary body assuming the declared shape died with TypeError: no implicit conversion of Symbol into Integer — a 500 on malformed input. The same held for an array scope declared inside a hash (requires :outer, type: Hash do requires :inner, type: Array do ... end end).

Array[Integer] and type: Hash scopes already rejected the equivalent shape; only the block form was affected.

Approach

Each scope now records at definition time how many Array-typed scopes sit on its chain (ParamsScope#array_depth). The iterator descends that many levels, less the one Array.wrap already consumes in #each, and yields anything deeper as-is. The attribute validators then see a non-hash and fail it exactly as they do for any other unexpected element type (hash_like? is respond_to?(:key?), which an Array is not), so these requests get the 400 they always should have — no new error path.

Declared nesting is unaffected: requires :a, type: Array do requires :b, type: Array do ... end end still descends both levels and still reports a[0][b][0][c] is missing.

Backward compatibility

Requests that were previously accepted through the silent unwrap are now rejected with 400. In practice those requests could not be served — the endpoint received a shape it never declared — so this converts a 500 into the correct 4xx rather than removing working behaviour.

Not a regression; the behaviour is present in 3.3.4 and earlier.

Test plan

• Five new examples in params_scope_spec.rb covering the flat, hash-wrapped and declared-nested cases; verified they fail without the lib/ change.
• Full RSpec suite passes locally (2543 examples, 0 failures).
• RuboCop clean.
• CI green.

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run