Skip to content

Fix nested form body parsing happening for all content types#305

Open
cllns wants to merge 5 commits intomainfrom
fix/router-content-type-aware-body-parsing
Open

Fix nested form body parsing happening for all content types#305
cllns wants to merge 5 commits intomainfrom
fix/router-content-type-aware-body-parsing

Conversation

@cllns
Copy link
Copy Markdown
Member

@cllns cllns commented May 5, 2026

I have a JSON API Hanami app and when benchmarking it, I had some generated code that POSTed with "%" in a field, as in "Improves speeds by 50%". This surprisingly raised a Rack::QueryParser::InvalidParameterError.

This is because we run Rack::Utils.parse_nested_query on the request body for every request, regardless of Content-Type. This causes JSON bodies to leak into router.params (as evidenced by the JSON regression test failure added here: {from: "ui", "{\"foo\":\"bar\"}": nil}), while bodies containing a literal % (#237) or multipart binary bytes (#296, other regression test) raise Rack::QueryParser::InvalidParameterError because it's being parsed as form input (nested query) and the % is interpreted as malformed URL encoding.

#237 was closed with #240 as the workaround, but that was at a different time in the frameworks history: when we required JSON parsing to be done via a body parser in this repo. Now we're more flexible and parse it later on, so the problem gets triggered upstream. This fixes it at its proper place, only using ::Rack::Utils.parse_nested_query for forms.

Closes #296

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rack::QueryParser::InvalidParameterError on multipart/form-data submission

1 participant