Update Filter Attributes to perform exact matches instead of Fuzzy matches

[keshavbiswa]

Motivation / Background

This Pull Request has been created because of a bug mentioned in #51254 wherein encrypting one attribute in a model filters out other similar matching attributes in inspect.

Detail

This PR makes the following changes:

• Updates filter_attributes to exact regex matches instead of fuzzy matching

Checklist

Before submitting the PR make sure the following are checked:

• This Pull Request is related to one change. Unrelated changes should be opened in separate PRs.
• Commit message has a detailed description of what changed and why. If this PR fixes a related issue include it in the commit message. Ex: [Fix #issue-number]
• Tests are added or updated if you fix a bug or add a feature.
• CHANGELOG files are updated for the changed libraries if there is a behavior change or additional feature. Minor bug fixes and documentation changes should not be included.

[bdewater]

I don't think an extra argument is needed when you already can pass a regex to precisely filter:

rails/activesupport/lib/active_support/parameter_filter.rb

Lines 25 to 28 in f613ba8

	# # Replaces values for the exact key "pin" and for keys that begin with
	# # "pin_". Does not match keys that otherwise include "pin" as a
	# # substring, such as "shipping_id".
	# ActiveSupport::ParameterFilter.new([/\Apin\z/, /\Apin_/])

IMO better would be for auto_filtered_parameters.rb to compile a more precise regex than ParameterFilter.precompile_filters does when given a string/symbol.

[keshavbiswa]

I don't think an extra argument is needed when you already can pass a regex to precisely filter:

rails/activesupport/lib/active_support/parameter_filter.rb

Lines 25 to 28 in f613ba8

	# # Replaces values for the exact key "pin" and for keys that begin with
	# # "pin_". Does not match keys that otherwise include "pin" as a
	# # substring, such as "shipping_id".
	# ActiveSupport::ParameterFilter.new([/\Apin\z/, /\Apin_/])

IMO better would be for auto_filtered_parameters.rb to compile a more precise regex than ParameterFilter.precompile_filters does when given a string/symbol.

You're right. adding this line does fix the problem:

            klass.filter_attributes += [ /^#{attribute}$/ ]

My concern was if we ever need to do the same then it would make sense to have a seperate approach for it altogether.
But then again, I'd be willing to remove and replace just this line if we don't want to add any more methods as well.

[hahmed]

I don't think an extra argument is needed when you already can pass a regex to precisely filter:

+1 to this

Maybe we can add a config value to switch between fuzzy and exact match with the default being what we have currently (fuzzy)? I don't think we should have one or the other, not sure that's a consistent experience with how Filtering is currently used.

[keshavbiswa]

I don't think an extra argument is needed when you already can pass a regex to precisely filter:

+1 to this

Maybe we can add a config value to switch between fuzzy and exact match with the default being what we have currently (fuzzy)? I don't think we should have one or the other, not sure that's a consistent experience with how Filtering is currently used.

I don't think for encryption we need fuzzy matches. If i'm encrypting name I'd only expect name to be filtered and not first_name or name_entered.

[bdewater]

Agreed 👍

Can you update the pull request title and add a CHANGELOG entry? Hopefully it'll be merged soon :)

[keshavbiswa]

Updated the CHANGELOG and the description.