Skip to content
Browse files

Make Parameters support legacy YAML encodings.

By changing ActionController::Parameter's superclass, Rails 5 also changed
the YAML serialization format.

Since YAML doesn't know how to handle parameters it would fallback to its
routine for the superclass, which in Rails 4.2 was Hash while just Object
in Rails 5. As evident in the tags YAML would spit out:

4.2: !ruby/hash-with-ivars:ActionController::Parameters
5.0: !ruby/object:ActionController::Parameters

Thus when loading parameters YAML from 4.2 in Rails 5, it would parse a
hash dump as it would an Object class.

To fix this we have to provide our own `init_with` to be aware of the past
format as well as the new one. Then we add a `load_tags` mapping, such that
when the YAML parser sees `!ruby/hash-with-ivars:ActionController::Parameters`,
it knows to call our `init_with` function and not try to instantiate it as
a normal hash subclass.
  • Loading branch information
kaspth committed Aug 1, 2016
1 parent c205e3f commit 31448f2b7fa6f3920485229e5710d9fcf87f190d
@@ -7,6 +7,12 @@
require 'rack/test'
require 'stringio'
require 'set'
require 'yaml'

# Wire up YAML format compatibility with Rails 4.2. Makes the YAML parser call
# `init_with` when it encounters `!ruby/hash-with-ivars:ActionController::Parameters`,
# instead of trying to parse it as a regular hash subclass.
YAML.load_tags['!ruby/hash-with-ivars:ActionController::Parameters'] = 'ActionController::Parameters'

module ActionController
# Raised when a required parameter is missing.
@@ -591,6 +597,19 @@ def inspect
"<#{self.class} #{@parameters} permitted: #{@permitted}>"

def init_with(coder) # :nodoc:
# YAML's Hash subclass format from Rails 4.2, where keys and values
# were stored under an elements hash and `permitted` within an ivars hash.
@parameters =['elements'].with_indifferent_access
@permitted =['ivars'][:@permitted]
# YAML's Object format. Only needed because of the format
# backwardscompability above, otherwise equivalent to YAML's initialization.
@parameters, @permitted =['parameters'],['permitted']

def method_missing(method_sym, *args, &block)
if @parameters.respond_to?(method_sym)
message = <<-DEPRECATE.squish
@@ -0,0 +1,32 @@
require 'abstract_unit'
require 'action_controller/metal/strong_parameters'
require 'active_support/core_ext/string/strip'

class ParametersSerializationTest < ActiveSupport::TestCase
test 'yaml serialization' do
assert_equal <<-end_of_yaml.strip_heredoc, YAML.dump( :value))
--- !ruby/object:ActionController::Parameters
parameters: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
key: :value
permitted: false

test 'yaml deserialization' do
params = :value)
roundtripped = YAML.load(YAML.dump(params))

assert_equal params, roundtripped
assert_not roundtripped.permitted?

test 'yaml backwardscompatible with hash inheriting parameters' do
assert_equal :value), YAML.load(<<-end_of_yaml.strip_heredoc)
--- !ruby/hash-with-ivars:ActionController::Parameters
key: :value
:@permitted: false

0 comments on commit 31448f2

Please sign in to comment.
You can’t perform that action at this time.