ActionDispatch::Request.deep_munge (action_dispatch/http/request.rb) assumes it receives a hash. This breaks if you pass a JSON string/int/float/nil (e.g. "adasd") in the POST/PUT request with application/json content type.
The typical example is when modifying an attribute in a RESTful manner - PUT /user/name where 'name' is an attribute of user, which results in an exception in Rails' stack.
The offending call is in lib/action_dispatch/middleware/params_parser.rb:47. Unlike the fix for handling of XMLs, it should test if JSON.decode returned a non-object (string/int/float/array/nil) and call deep_munge only if it's a hash.
NoMethodError (undefined method `each' for "my_new_attr_content":String)
actionpack (3.2.11) lib/action_dispatch/http/request.rb:252:in `deep_munge'
actionpack (3.2.11) lib/action_dispatch/middleware/params_parser.rb:47:in `parse_formatted_parameters'
actionpack (3.2.11) lib/action_dispatch/middleware/params_parser.rb:17:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/flash.rb:242:in `call'
Commit causing this: d5cd97b
Similar issue - but not the same: #8832
Fix json params parsing regression for non-object JSON content.