Harden mounted-app auth surface and error HTML escaping

[ericproulx]

Two security-relevant fixes surfaced by a review of Grape::API.

1. Error HTML escaping bypassable via a charset parameter

Grape::Middleware::Error#rack_response escaped the error message only when the response content-type was exactly text/html:

message = Rack::Utils.escape_html(message) if headers[Rack::CONTENT_TYPE] == 'text/html'

A parameterized value such as text/html; charset=utf-8 fails the == check and skips escaping, so a reflected message (e.g. via error!, rescue_from, or a validation message) can be returned unescaped into an HTML response. The framework's own default 406 uses a bare text/html and stayed safe, but the check itself was wrong. It now compares the media type only (parameters stripped).

2. Authentication does not wrap mounted bare Rack apps

A bare Rack app mounted with mount is called directly and never goes through the endpoint middleware stack (@app = config.app || build_stack), so an API's authentication middleware does not wrap it and the mount is reachable unauthenticated:

class ProtectedAPI < Grape::API
  http_basic { |u, p| u == 'admin' && p == 'secret' }
  mount LegacyRackApp => '/legacy'   # reachable with no credentials
end

Mounted Grape APIs are unaffected because they rebuild their own stack from the inherited settings. Rather than change the call path (auto-wrapping mounted Rack apps would break apps that mount bare Rack apps expecting passthrough), this warns at compile time when a bare Rack app is mounted under configured authentication, so the bypass isn't silent.

Tests

• Regression spec for the charset-escaping bypass.
• Specs asserting the warning fires under authentication, and does not fire without authentication or for a mounted Grape API.
• api_spec + endpoint_spec + error_spec: 573 examples, 0 failures. RuboCop clean.

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run