Stop fetch from mutating when default is a hash

lib/action_controller/parameters.rb

@@ -79,7 +79,14 @@ def [](key)
     end
 
     def fetch(key, *args)
-      convert_hashes_to_parameters(key, super)
+      value = super
+      # Don't rely on +convert_hashes_to_parameters+
+      # so as to not mutate via a +fetch+
+      if value.is_a?(Hash)
+        value = self.class.new(value)
+        value.permit! if permitted?
+      end
+      value
     rescue KeyError, IndexError
       raise ActionController::ParameterMissing.new(key)
     end

test/parameters_taint_test.rb

@@ -22,6 +22,13 @@ class ParametersTaintTest < ActiveSupport::TestCase
     end
   end
 
+  test "fetch where the default is a hash will not mutate the instance" do
+    @params.fetch :foo, {}
+    assert !@params.has_key?(:foo)
+    @params.fetch :foo, {:fizz => :buzz}
+    assert !@params.has_key?(:foo)
+  end
+
   test "not permitted is sticky on accessors" do
     assert !@params.slice(:person).permitted?
     assert !@params[:person][:name].permitted?