Fixes #22285 - Raise error when strong params filters out params #5183

tbrisker · 2018-01-17T14:06:12Z

Currently we silently filter out parameters (or log in production),
causing unexpected results when passing an invalid param (either
incorrect name or incorrect type). This can lead to unexpected results,
since the user, seeing no error, assumes the request was successful when
in fact some of the parameters were filtered out.

theforeman-bot · 2018-01-17T14:06:19Z

Issues: #22285

tbrisker · 2018-01-17T14:40:49Z

This currently Breaks All Things. setting to WoC to figure out.

tbrisker · 2018-01-17T16:09:44Z

Previously had 636 failing tests, still WIP to fix all broken tests.

tbrisker · 2018-01-17T16:11:00Z

test/controllers/api/v2/hosts_controller_test.rb

@@ -314,7 +314,7 @@ def expect_attribute_modifier(modifier_class, args)

  test "should update hostgroup_id of host" do
    @host = FactoryBot.create(:host, basic_attrs_with_hg)
-    put :update, params: { :id => @host.to_param, :hostgroup_id => Hostgroup.last.id }


The last hostgroup doesn't necessarily have an environment, which is required, and reset if the hg changes.

iNecas · 2018-01-17T17:45:10Z

Could we wait with this change until 1.17 is out + a week or two: many plugin authors haven't had green tests for a while, so would be good to give them some time to actually do other things than catching up with upstream breakages?

tbrisker · 2018-01-17T18:27:19Z

Down to 237 :)

tbrisker · 2018-01-17T18:45:39Z

@iNecas I expect fixing all tests and reviewing it will take several days at best. I don't mind waiting a bit but it will be painful to keep up to date over a long period. Besides the impact on users and developers I outlined on discourse, this also exposes multiple tests which we thought were passing when in fact they were failing silently - I am still digging into it, but there may be other bugs discovered due to these tests. In other words - the sooner we fix this properly the better.
That being said, I think for most plugins fixing this would be a matter of adding a few parameters to the filters already in place; any broken tests discovered due to this are actually broken already without us knowing it. Once I finish doing the core part of it, I'll try looking into some of the plugins.

houndci-bot · 2018-01-22T16:23:19Z

test/controllers/concerns/parameters/auth_source_ldap_test.rb

-    refute_includes self.class.auth_source_ldap_params_filter.filter_params(params, context), 'type'
+    assert_raises ActionController::UnpermittedParameters do
+      self.class.auth_source_ldap_params_filter.filter_params(params, context)
+   end


end at 12, 3 is not aligned with assert_raises ActionController::UnpermittedParameters do at 10, 4.

houndci-bot · 2018-01-22T16:23:19Z

test/controllers/concerns/parameters/auth_source_ldap_test.rb

@@ -7,6 +7,8 @@ class AuthSourceLdapParametersTest < ActiveSupport::TestCase

  test "filters STI :type field" do
    params = ActionController::Parameters.new(:auth_source_ldap => {:type => AuthSourceHidden.name})
-    refute_includes self.class.auth_source_ldap_params_filter.filter_params(params, context), 'type'
+    assert_raises ActionController::UnpermittedParameters do
+      self.class.auth_source_ldap_params_filter.filter_params(params, context)


Use 2 (not 3) spaces for indentation.

thomasmckay · 2018-01-25T13:58:09Z

@waldenraines FYI - This will require significant effort to fix and test the katello UI since when an item is edited its json is often sent back to server with extra fields. Product edit, for example, gets "An error occurred saving the Product: found unpermitted parameters: :cp_id, :created_at, :updated_at". This will be common on all of the pages, I think.

mmoll · 2018-04-01T16:41:35Z

@tbrisker please rebase :)

Currently we silently filter out parameters (or log in production), causing unexpected results when passing an invalid param (either incorrect name or incorrect type). This can lead to unexpected results, since the user, seeing no error, assumes the request was successful when in fact some of the parameters were filtered out.

- fix users controller tests A user cannot change their own auth_source. Passing illegal parameters should raise ActionController::UnpermittedParameters - Fix auth_source_ldap controller tests

houndci-bot

Some files could not be reviewed due to errors:

Error: The `Style/TrailingCommaInLiteral` cop no longer exists. Please use `S...

Error: The `Style/TrailingCommaInLiteral` cop no longer exists. Please use `Style/TrailingCommaInArrayLiteral` and/or `Style/TrailingCommaInHashLiteral` instead.
(obsolete configuration found in .rubocop.yml, please update it)
The `Performance/HashEachMethods` cop has been removed since it no longer provides performance benefits in modern rubies.

houndci-bot

Some files could not be reviewed due to errors:

Error: The `Style/TrailingCommaInLiteral` cop no longer exists. Please use `S...

Error: The `Style/TrailingCommaInLiteral` cop no longer exists. Please use `Style/TrailingCommaInArrayLiteral` and/or `Style/TrailingCommaInHashLiteral` instead.
(obsolete configuration found in .rubocop.yml, please update it)
The `Performance/HashEachMethods` cop has been removed since it no longer provides performance benefits in modern rubies.

tbrisker · 2018-04-02T08:03:40Z

rebased, now lets see how many new test have broken in the last 2 months...

mmoll · 2018-04-24T19:15:25Z

@tbrisker this needs a rebase :)

I think this should go in soon, especially now that 1.18 is branched.

mmoll · 2018-06-02T21:20:17Z

@tbrisker ping?

tbrisker · 2018-06-05T12:55:58Z

@mmoll last time i tried to get this mergeable i figured out there's some refactoring to the host[group] form that's needed to fix one of the issues, GH-5458 is WIP to fix that. Once I finish with that this one is next in line.

theforeman-bot · 2019-01-16T01:23:35Z

Thank you for your contribution, @tbrisker! This PR has been inactive for 6 months, closing for now.
Feel free to reopen when you return to it. This is an automated process.

ares · 2019-01-16T07:23:35Z

😢

theforeman-bot added Waiting on contributor Needs testing Not yet reviewed labels Jan 17, 2018

tbrisker force-pushed the 22285 branch from 10138c5 to f5272aa Compare January 17, 2018 14:06

theforeman-bot added Needs testing and removed Waiting on contributor labels Jan 17, 2018

tbrisker changed the title ~~Fixes #22285 - Raise error when strong parameters filters out params~~ Fixes #22285 - Raise error when strong params filters out params Jan 17, 2018

tbrisker added Waiting on contributor and removed Needs testing Not yet reviewed labels Jan 17, 2018

theforeman-bot added Needs re-review Needs testing and removed Waiting on contributor labels Jan 17, 2018

tbrisker added Waiting on contributor and removed Needs re-review Needs testing labels Jan 17, 2018

tbrisker commented Jan 17, 2018

View reviewed changes

lzap mentioned this pull request Jan 19, 2018

Fixes #22325 - permit additional params theforeman/foreman_discovery#407

Merged

tbrisker force-pushed the 22285 branch from a288c54 to 7f8511d Compare January 21, 2018 13:50

theforeman-bot added Needs re-review Needs testing and removed Waiting on contributor labels Jan 21, 2018

tbrisker force-pushed the 22285 branch 2 times, most recently from 0831607 to e4c080b Compare January 22, 2018 16:22

houndci-bot reviewed Jan 22, 2018

View reviewed changes

tbrisker force-pushed the 22285 branch from e4c080b to 44b635e Compare January 22, 2018 16:28

theforeman deleted a comment from theforeman-bot Jan 22, 2018

tbrisker force-pushed the 22285 branch 6 times, most recently from b713bec to 1960afd Compare January 24, 2018 17:17

tbrisker force-pushed the 22285 branch from 1960afd to 14e6b91 Compare February 1, 2018 11:53

tbrisker mentioned this pull request Mar 15, 2018

Refs #22285 - Prepare for strong params enforcement #5330

Merged

tbrisker added 2 commits April 2, 2018 10:58

Refs #22285 - Fix tests for strong params enforcement

0519bfd

- fix users controller tests A user cannot change their own auth_source. Passing illegal parameters should raise ActionController::UnpermittedParameters - Fix auth_source_ldap controller tests

tbrisker force-pushed the 22285 branch from d7d633d to 0519bfd Compare April 2, 2018 08:00

houndci-bot reviewed Apr 2, 2018

View reviewed changes

ares added the Waiting on contributor label Apr 8, 2018

tbrisker added the WIP label Jul 15, 2018

theforeman-bot added the Inactive label Jan 16, 2019

theforeman-bot closed this Jan 16, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #22285 - Raise error when strong params filters out params #5183

Fixes #22285 - Raise error when strong params filters out params #5183

tbrisker commented Jan 17, 2018

theforeman-bot commented Jan 17, 2018

tbrisker commented Jan 17, 2018

tbrisker commented Jan 17, 2018 •

edited

tbrisker Jan 17, 2018

iNecas commented Jan 17, 2018

tbrisker commented Jan 17, 2018 •

edited

tbrisker commented Jan 17, 2018

houndci-bot Jan 22, 2018

houndci-bot Jan 22, 2018

thomasmckay commented Jan 25, 2018

mmoll commented Apr 1, 2018

houndci-bot left a comment

houndci-bot left a comment

tbrisker commented Apr 2, 2018

mmoll commented Apr 24, 2018

mmoll commented Jun 2, 2018

tbrisker commented Jun 5, 2018

theforeman-bot commented Jan 16, 2019

ares commented Jan 16, 2019

Fixes #22285 - Raise error when strong params filters out params #5183

Fixes #22285 - Raise error when strong params filters out params #5183

Conversation

tbrisker commented Jan 17, 2018

theforeman-bot commented Jan 17, 2018

tbrisker commented Jan 17, 2018

tbrisker commented Jan 17, 2018 • edited

tbrisker Jan 17, 2018

Choose a reason for hiding this comment

iNecas commented Jan 17, 2018

tbrisker commented Jan 17, 2018 • edited

tbrisker commented Jan 17, 2018

houndci-bot Jan 22, 2018

Choose a reason for hiding this comment

houndci-bot Jan 22, 2018

Choose a reason for hiding this comment

thomasmckay commented Jan 25, 2018

mmoll commented Apr 1, 2018

houndci-bot left a comment

Choose a reason for hiding this comment

houndci-bot left a comment

Choose a reason for hiding this comment

tbrisker commented Apr 2, 2018

mmoll commented Apr 24, 2018

mmoll commented Jun 2, 2018

tbrisker commented Jun 5, 2018

theforeman-bot commented Jan 16, 2019

ares commented Jan 16, 2019

tbrisker commented Jan 17, 2018 •

edited

tbrisker commented Jan 17, 2018 •

edited