Skip to content

Conversation

@geemus
Copy link
Member

@geemus geemus commented Oct 24, 2025

fixes #454

Copy link
Member

@ydah ydah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems good! I thought it would be better to have test code for this change, but is it difficult to write test code for this change? (This is not a blocker of merges)

@geemus
Copy link
Member Author

geemus commented Oct 27, 2025

@ydah Good point. I had at least in part done this so the person reporting the issue could check and see if it fixed their problem (which it did), but tests would be good before proceeding for sure.

@geemus
Copy link
Member Author

geemus commented Oct 27, 2025

Awaiting confirmation from #454 that it works as expected in Rails and doesn't break anything. Would be good to have testing here also (should be easier around schema validator, somewhat harder on the operation wrapper since it's a bit buried in internals). Might need to rework things a bit to better facilitate testing, but I'll wait for confirmation, lest I waste time on testing the wrong things.

- Add test cases for Committee::SchemaValidator#request_media_type
- Verify parsing of simple, comma-separated, and semicolon-separated content types
- Ensure correct media type extraction from request headers
@geemus
Copy link
Member Author

geemus commented Oct 30, 2025

#454 was confirmed and I've added some basic tests around the schema_validator at least (where it's more accessible).

@geemus geemus merged commit 1261271 into master Oct 30, 2025
8 checks passed
@geemus geemus deleted the fix-content-type-parsing branch October 30, 2025 13:36
@geemus
Copy link
Member Author

geemus commented Oct 30, 2025

Released in v5.6.1

@fredplante
Copy link

Thank you @geemus 🙌

@ydah
Copy link
Member

ydah commented Nov 1, 2025

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Malformed content-type header allows to bypass request validation

4 participants