We were using presence for a reason -- when you wrap parameters via j…

…son calls, you will get an empty hash on no params -- exactly what we are trying to protect against

lib/action_controller/parameters.rb

@@ -26,6 +26,10 @@ def permit!
       self
     end
 
+    def required(key)
+      self[key].presence || raise(ActionController::ParameterMissing.new(key))
+    end
+
     def permit(*keys)
       slice(*keys).permit!
     end
@@ -38,9 +42,9 @@ def fetch(key)
       unless block_given? || key?(key)
         raise ActionController::ParameterMissing.new(key)
       end
+
       convert_hashes_to_parameters(key, super)
     end
-    alias :required :fetch
 
     def slice(*keys)
       self.class.new(super)

test/parameters_require_test.rb

@@ -0,0 +1,10 @@
+require 'test_helper'
+require 'action_controller/parameters'
+
+class ParametersRequireTest < ActiveSupport::TestCase
+  test "required parameters must be present not merely not nil" do
+    assert_raises(ActionController::ParameterMissing) do
+      ActionController::Parameters.new(person: {}).required(:person)
+    end
+  end
+end

test/parameters_taint_test.rb

@@ -8,11 +8,6 @@ class ParametersTaintTest < ActiveSupport::TestCase
     }})
   end
 
-  test "empty values are OK" do
-    @params[:foo] = {}
-    assert @params.required(:foo)
-  end
-
   test "fetch raises ParameterMissing exception" do
     e = assert_raises(ActionController::ParameterMissing) do
       @params.fetch :foo