Handle EOFError raised by Rack (#2161)

Author: bschmeck

.github/workflows/test.yml

@@ -33,6 +33,7 @@ jobs:
           - Gemfile
           - gemfiles/rack1.gemfile
           - gemfiles/rack2.gemfile
+          - gemfiles/rack2_2.gemfile
           - gemfiles/rack_edge.gemfile
           - gemfiles/rails_5.gemfile
           - gemfiles/rails_6.gemfile
@@ -76,15 +77,15 @@ jobs:
 
     - name: Run tests
       run: bundle exec rake spec
-    
+
     - name: Run tests (spec/integration/eager_load)
       if: ${{ matrix.gemfile == 'Gemfile' }}
       run: bundle exec rspec spec/integration/eager_load
 
     - name: Run tests (spec/integration/multi_json)
       if: ${{ matrix.gemfile == 'gemfiles/multi_json.gemfile' }}
       run: bundle exec rspec spec/integration/multi_json
-   
+
     - name: Run tests (spec/integration/multi_xml)
       if: ${{ matrix.gemfile == 'gemfiles/multi_xml.gemfile' }}
       run: bundle exec rspec spec/integration/multi_xml

CHANGELOG.md

@@ -8,6 +8,8 @@
 
 * Your contribution here.
 
+* [#2161](https://github.com/ruby-grape/grape/pull/2157): Handle EOFError from Rack when given an empty multipart body - [@bschmeck](https://github.com/bschmeck).
+
 ### 1.5.2 (2021/02/06)
 
 #### Features

gemfiles/rack2_2.gemfile

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+# This file was generated by Appraisal
+
+source 'https://rubygems.org'
+
+gem 'rack', '~> 2.2'
+
+group :development, :test do
+  gem 'bundler'
+  gem 'hashie'
+  gem 'rake'
+  gem 'rubocop', '1.7.0'
+  gem 'rubocop-ast', '1.3.0'
+  gem 'rubocop-performance', '1.9.1', require: false
+end
+
+group :development do
+  gem 'appraisal'
+  gem 'benchmark-ips'
+  gem 'benchmark-memory'
+  gem 'guard'
+  gem 'guard-rspec'
+  gem 'guard-rubocop'
+end
+
+group :test do
+  gem 'cookiejar'
+  gem 'coveralls_reborn'
+  gem 'grape-entity', '~> 0.6'
+  gem 'maruku'
+  gem 'mime-types'
+  gem 'rack-jsonp', require: 'rack/jsonp'
+  gem 'rack-test', '~> 1.1.0'
+  gem 'rspec', '~> 3.0'
+  gem 'ruby-grape-danger', '~> 0.2.0', require: false
+end
+
+gemspec path: '../'

lib/grape.rb

@@ -76,6 +76,7 @@ module Exceptions
       autoload :InvalidVersionHeader
       autoload :MethodNotAllowed
       autoload :InvalidResponse
+      autoload :EmptyMessageBody
     end
   end
 

lib/grape/exceptions/empty_message_body.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Grape
+  module Exceptions
+    class EmptyMessageBody < Base
+      def initialize(body_format)
+        super(message: compose_message(:empty_message_body, body_format: body_format), status: 400)
+      end
+    end
+  end
+end

lib/grape/locale/en.yml

@@ -44,11 +44,11 @@ en:
             "when specifying %{body_format} as content-type, you must pass valid
             %{body_format} in the request's 'body'
             "
+        empty_message_body: 'Empty message body supplied with %{body_format} content-type'
         invalid_accept_header:
           problem: 'Invalid accept header'
           resolution: '%{message}'
         invalid_version_header:
           problem: 'Invalid version header'
           resolution: '%{message}'
         invalid_response: 'Invalid response'
-

lib/grape/request.rb

@@ -15,6 +15,8 @@ def initialize(env, **options)
 
     def params
       @params ||= build_params
+    rescue EOFError
+      raise Grape::Exceptions::EmptyMessageBody, content_type
     end
 
     def headers

spec/grape/endpoint_spec.rb

@@ -420,6 +420,19 @@ def app
         expect(last_response.status).to eq(201)
         expect(last_response.body).to eq('Bob')
       end
+
+      # Rack swallowed this error until v2.2.0
+      it 'returns a 400 if given an invalid multipart body', if: Gem::Version.new(Rack.release) >= Gem::Version.new('2.2.0') do
+        subject.params do
+          requires :file, type: Rack::Multipart::UploadedFile
+        end
+        subject.post '/upload' do
+          params[:file][:filename]
+        end
+        post '/upload', { file: '' }, 'CONTENT_TYPE' => 'multipart/form-data; boundary=foobar'
+        expect(last_response.status).to eq(400)
+        expect(last_response.body).to eq('Empty message body supplied with multipart/form-data; boundary=foobar content-type')
+      end
     end
 
     it 'responds with a 415 for an unsupported content-type' do