Fix cascaded routes leaking routing args into the next matched route

[ericproulx]

Problem

Grape::Router#process_route seeds the routing args once and then merges every subsequent attempt's captures into the same Hash:

env[Grape::Env::GRAPE_ROUTING_ARGS] ||= { route_info: route }
env[Grape::Env::GRAPE_ROUTING_ARGS].merge!(route_params) if route_params.present?

When a matched route responds with X-Cascade: pass (the canonical case: header/accept-version versioning with cascade: true), #rotation (and the '*'-method fallback in #transaction) tries the next candidate route — but process_route runs again on an env whose routing args were already populated by the failed attempt. Because of the ||=, two things go wrong for the route that ultimately serves the request:

• :route_info still points at the first (cascaded) route. The route helper inside the endpoint returns the wrong route, and ErrorFormatter::Base#present resolves http_codes entity presenters from the wrong route's metadata.
• The failed attempt's path captures merge into params. Any capture name the winning route doesn't declare survives the merge and shows up in the endpoint's params.

Reproduction

v2 = Class.new(Grape::API) do
  version 'v2', using: :header, vendor: 'grape', cascade: true
  get ':id' { { from: 'v2' } }
end
v1 = Class.new(Grape::API) do
  format :json
  version 'v1', using: :header, vendor: 'grape'
  get ':name' { { origin: route.origin, params: params.to_h } }
end
app = Class.new(Grape::API) { mount v2; mount v1 }

GET /123 with Accept: application/vnd.grape-v1+json — the v2 route matches first, its versioner cascades, and the v1 endpoint then responds with:

{"origin":"/:id","params":{"id":"123","name":"123"}}

route.origin belongs to the v2 route it never ran, and params[:id] is a capture the v1 route never declared. Expected (and after this fix):

{"origin":"/:name","params":{"name":"123"}}

Fix

Build a fresh { route_info: route }.merge(route_params) on every process_route call. The router is the only writer of env['grape.routing_args'] (readers: Grape::Request#make_params, the route helper, and ErrorFormatter::Base), so resetting per attempt is safe — including for the greedy OPTIONS/405 helper routes, whose params_for yields no captures and which previously ran with an unset or unrelated args Hash anyway.

This behavior predates the recent router refactors — the ||=/seed-once shape goes back through #2754, #2689 and #2636 to the original make_routing_args(default_args || { route_info: route }).

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run