From 45f632b58b9fa42abe80c678312063b14fec4037 Mon Sep 17 00:00:00 2001 From: ydah Date: Thu, 24 Sep 2026 16:20:52 +0900 Subject: [PATCH] Return 400 for invalid UTF-8 query parameters --- .../schema_validator/open_api_3/operation_wrapper.rb | 2 +- test/middleware/request_validation_open_api_3_test.rb | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/committee/schema_validator/open_api_3/operation_wrapper.rb b/lib/committee/schema_validator/open_api_3/operation_wrapper.rb index 19bc1afb..7092122d 100644 --- a/lib/committee/schema_validator/open_api_3/operation_wrapper.rb +++ b/lib/committee/schema_validator/open_api_3/operation_wrapper.rb @@ -128,7 +128,7 @@ def build_openapi_parser_option(validator_option, coerce_value) def validate_get_request_params(query_params, headers, validator_option) validate_query_params(query_params, headers, validator_option) - rescue OpenAPIParser::OpenAPIError => e + rescue OpenAPIParser::OpenAPIError, ArgumentError => e raise Committee::InvalidRequest.new(e.message, original_error: e) end diff --git a/test/middleware/request_validation_open_api_3_test.rb b/test/middleware/request_validation_open_api_3_test.rb index 340c662d..1c24572e 100644 --- a/test/middleware/request_validation_open_api_3_test.rb +++ b/test/middleware/request_validation_open_api_3_test.rb @@ -661,6 +661,15 @@ def app end describe 'bracket-style query params' do + it 'returns a bad request for query parameters with invalid UTF-8 bytes' do + parameter = { 'name' => 'query_string', 'in' => 'query', 'required' => true, 'schema' => { 'type' => 'string', 'maxLength' => 10, 'pattern' => '^[A-Z]+$' }, } + @app = new_rack_app(schema: query_param_schema(parameter)) + + get '/events?query_string=%c0%af' + + assert_equal 400, last_response.status + end + it 'validates query params declared with bracket notation names' do check_parameter = lambda { |env| assert_equal '/test', env['committee.query_hash']['filter[slug]']