Permalink
Browse files

Allow developers to enable raising of exception when unexpected param…

…s are provided.
  • Loading branch information...
1 parent c9402c0 commit 08578bb40a66aa3c73edab8eef795da6647ed694 @thomasfedb thomasfedb committed Jan 5, 2013
@@ -20,6 +20,20 @@ def initialize(param) # :nodoc:
end
end
+ # Raised when a supplied parameter is not expected.
+ #
+ # params = ActionController::Parameters.new(a: "123", b: "456")
+ # params.permit(:c)
+ # # => ActionController::UnexpectedParameter: found unexpected keys: a, b
+ class UnexpectedParameters < IndexError
+ attr_reader :params
+
+ def initialize(params)
+ @params = params
+ super("found unexpected keys: #{params.join(", ")}")
+ end
+ end
+
# == Action Controller \Parameters
#
# Allows to choose which attributes should be whitelisted for mass updating
@@ -66,6 +80,7 @@ def initialize(param) # :nodoc:
# params["key"] # => "value"
class Parameters < ActiveSupport::HashWithIndifferentAccess
cattr_accessor :permit_all_parameters, instance_accessor: false
+ cattr_accessor :raise_on_unexpected, instance_accessor: false
# Returns a new instance of <tt>ActionController::Parameters</tt>.
# Also, sets the +permitted+ attribute to the default value of
@@ -223,6 +238,13 @@ def permit(*filters)
end
end
+ if Parameters.raise_on_unexpected
+ unexpected_keys = self.keys - params.keys
+ if unexpected_keys.any?
+ raise ActionController::UnexpectedParameters.new(unexpected_keys)
+ end
+ end
+
params.permit!
end
@@ -21,21 +21,24 @@ class Railtie < Rails::Railtie #:nodoc:
initializer "action_controller.parameters_config" do |app|
ActionController::Parameters.permit_all_parameters = app.config.action_controller.delete(:permit_all_parameters) { false }
+ ActionController::Parameters.raise_on_unexpected = app.config.action_controller.raise_on_unexpected_params
end
initializer "action_controller.set_configs" do |app|
paths = app.config.paths
options = app.config.action_controller
- options.logger ||= Rails.logger
- options.cache_store ||= Rails.cache
+ options.logger ||= Rails.logger
+ options.cache_store ||= Rails.cache
- options.javascripts_dir ||= paths["public/javascripts"].first
- options.stylesheets_dir ||= paths["public/stylesheets"].first
+ options.javascripts_dir ||= paths["public/javascripts"].first
+ options.stylesheets_dir ||= paths["public/stylesheets"].first
# Ensure readers methods get compiled
- options.asset_host ||= app.config.asset_host
- options.relative_url_root ||= app.config.relative_url_root
+ options.asset_host ||= app.config.asset_host
+ options.relative_url_root ||= app.config.relative_url_root
+
+ options.raise_on_unexpected_params ||= (Rails.env.test? || Rails.env.development?)
ActiveSupport.on_load(:action_controller) do
include app.routes.mounted_helpers
@@ -0,0 +1,33 @@
+require 'abstract_unit'
+require 'action_controller/metal/strong_parameters'
+
+class RaiseOnUnpermittedParamsTest < ActiveSupport::TestCase
+ def setup
+ ActionController::Parameters.raise_on_unexpected = true
+ end
+
+ def teardown
+ ActionController::Parameters.raise_on_unexpected = false
+ end
+
+ test "raises on unexpected params" do
+ params = ActionController::Parameters.new({
+ book: { pages: 65 },
+ fishing: "Turnips"
+ })
+
+ assert_raises(ActionController::UnexpectedParameters) do
+ params.permit(book: [:pages])
+ end
+ end
+
+ test "raises on unexpected nested params" do
+ params = ActionController::Parameters.new({
+ book: { pages: 65, title: "Green Cats and where to find then." }
+ })
+
+ assert_raises(ActionController::UnexpectedParameters) do
+ params.permit(book: [:pages])
+ end
+ end
+end

0 comments on commit 08578bb

Please sign in to comment.