Skip to content

compare URI-decoded path params#482

Merged
jkeen merged 6 commits intographiti-api:masterfrom
zvkemp:fix-encoded-params
Mar 16, 2025
Merged

compare URI-decoded path params#482
jkeen merged 6 commits intographiti-api:masterfrom
zvkemp:fix-encoded-params

Conversation

@zvkemp
Copy link
Contributor

@zvkemp zvkemp commented Oct 22, 2024

Mitigation for a regression introduced in #447.

URI-encoded path parameters should be decoded before comparing with the (already-decoded) param.

The URI decoder is automatically set to the rails router decoder when it is detected, or URI.decode_uri_component (Ruby >= 3.2). Users on older rubies without Rails can optionally configure it via Graphiti.config.uri_decoder = -> (uri) { ... } (but this is only necessary if you are doing endpoint validation for routes that have percent-encoded path parameters).

has_id = params[:id] || params[:data].try(:[], :id)
path = request_path
if [:update, :show, :destroy].include?(context_namespace) && has_id
if [:update, :show, :destroy].include?(action) && has_id
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

action is passed in by the caller; seems appropriate to use it here instead of duplicating the call to context_namespace

@jkeen jkeen merged commit 20b80dd into graphiti-api:master Mar 16, 2025
36 checks passed
github-actions bot pushed a commit that referenced this pull request Mar 16, 2025
## [1.7.8](v1.7.7...v1.7.8) (2025-03-16)

### Bug Fixes

* compare URI-decoded path params ([#482](#482)) ([20b80dd](20b80dd))
* correct issue with many_to_many when one of the models has a prefix to the intersection model association ([#449](#449)) ([dc28a4f](dc28a4f))
* lazy constantize relation resources ([#492](#492)) ([3cc2983](3cc2983))
@github-actions
Copy link

🎉 This PR is included in version 1.7.8 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants