RubyGems - actionpack - Versions diffs - 4.1.16 → 4.2.0.beta1 - Mend

actionpack 4.1.16 → 4.2.0.beta1

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (99) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +163 -690
data/README.rdoc +7 -2
data/lib/abstract_controller/base.rb +16 -6
data/lib/abstract_controller/callbacks.rb +28 -51
data/lib/abstract_controller/helpers.rb +0 -3
data/lib/abstract_controller/railties/routes_helpers.rb +3 -3
data/lib/abstract_controller/rendering.rb +1 -7
data/lib/abstract_controller/url_for.rb +1 -1
data/lib/action_controller.rb +1 -0
data/lib/action_controller/base.rb +2 -1
data/lib/action_controller/caching.rb +1 -1
data/lib/action_controller/caching/fragments.rb +7 -1
data/lib/action_controller/log_subscriber.rb +26 -25
data/lib/action_controller/metal.rb +11 -7
data/lib/action_controller/metal/conditional_get.rb +31 -6
data/lib/action_controller/metal/etag_with_template_digest.rb +50 -0
data/lib/action_controller/metal/force_ssl.rb +1 -1
data/lib/action_controller/metal/head.rb +2 -0
data/lib/action_controller/metal/http_authentication.rb +3 -15
data/lib/action_controller/metal/instrumentation.rb +4 -7
data/lib/action_controller/metal/live.rb +57 -6
data/lib/action_controller/metal/mime_responds.rb +17 -227
data/lib/action_controller/metal/redirecting.rb +14 -8
data/lib/action_controller/metal/renderers.rb +19 -3
data/lib/action_controller/metal/rendering.rb +2 -6
data/lib/action_controller/metal/request_forgery_protection.rb +75 -7
data/lib/action_controller/metal/streaming.rb +1 -1
data/lib/action_controller/metal/strong_parameters.rb +111 -11
data/lib/action_controller/metal/url_for.rb +11 -12
data/lib/action_controller/model_naming.rb +1 -1
data/lib/action_controller/railtie.rb +4 -0
data/lib/action_controller/test_case.rb +87 -75
data/lib/action_dispatch/http/cache.rb +1 -1
data/lib/action_dispatch/http/filter_parameters.rb +2 -2
data/lib/action_dispatch/http/headers.rb +43 -9
data/lib/action_dispatch/http/mime_negotiation.rb +10 -4
data/lib/action_dispatch/http/mime_type.rb +2 -16
data/lib/action_dispatch/http/parameter_filter.rb +1 -1
data/lib/action_dispatch/http/parameters.rb +11 -26
data/lib/action_dispatch/http/request.rb +30 -10
data/lib/action_dispatch/http/response.rb +52 -17
data/lib/action_dispatch/http/upload.rb +3 -8
data/lib/action_dispatch/http/url.rb +87 -70
data/lib/action_dispatch/journey/formatter.rb +18 -17
data/lib/action_dispatch/journey/gtg/builder.rb +3 -3
data/lib/action_dispatch/journey/gtg/simulator.rb +10 -7
data/lib/action_dispatch/journey/gtg/transition_table.rb +18 -26
data/lib/action_dispatch/journey/nfa/dot.rb +2 -2
data/lib/action_dispatch/journey/nfa/simulator.rb +1 -1
data/lib/action_dispatch/journey/nfa/transition_table.rb +5 -5
data/lib/action_dispatch/journey/nodes/node.rb +4 -0
data/lib/action_dispatch/journey/parser.rb +52 -60
data/lib/action_dispatch/journey/parser.y +11 -10
data/lib/action_dispatch/journey/path/pattern.rb +16 -19
data/lib/action_dispatch/journey/route.rb +3 -18
data/lib/action_dispatch/journey/router.rb +34 -65
data/lib/action_dispatch/journey/router/strexp.rb +9 -6
data/lib/action_dispatch/journey/routes.rb +0 -4
data/lib/action_dispatch/journey/visitors.rb +81 -92
data/lib/action_dispatch/journey/visualizer/index.html.erb +2 -2
data/lib/action_dispatch/middleware/cookies.rb +27 -31
data/lib/action_dispatch/middleware/debug_exceptions.rb +32 -3
data/lib/action_dispatch/middleware/exception_wrapper.rb +19 -17
data/lib/action_dispatch/middleware/flash.rb +7 -4
data/lib/action_dispatch/middleware/public_exceptions.rb +13 -8
data/lib/action_dispatch/middleware/remote_ip.rb +3 -3
data/lib/action_dispatch/middleware/request_id.rb +1 -1
data/lib/action_dispatch/middleware/session/cookie_store.rb +1 -1
data/lib/action_dispatch/middleware/show_exceptions.rb +1 -0
data/lib/action_dispatch/middleware/static.rb +22 -23
data/lib/action_dispatch/middleware/templates/rescues/_source.erb +22 -18
data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +36 -8
data/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb +2 -8
data/lib/action_dispatch/middleware/templates/rescues/{diagnostics.erb → diagnostics.html.erb} +0 -0
data/lib/action_dispatch/middleware/templates/rescues/diagnostics.text.erb +9 -0
data/lib/action_dispatch/middleware/templates/rescues/layout.erb +6 -0
data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +1 -24
data/lib/action_dispatch/middleware/templates/rescues/template_error.text.erb +0 -1
data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +119 -63
data/lib/action_dispatch/routing/endpoint.rb +10 -0
data/lib/action_dispatch/routing/inspector.rb +4 -11
data/lib/action_dispatch/routing/mapper.rb +399 -278
data/lib/action_dispatch/routing/polymorphic_routes.rb +190 -78
data/lib/action_dispatch/routing/redirection.rb +10 -12
data/lib/action_dispatch/routing/route_set.rb +224 -177
data/lib/action_dispatch/routing/url_for.rb +9 -4
data/lib/action_dispatch/testing/assertions.rb +11 -7
data/lib/action_dispatch/testing/assertions/dom.rb +2 -26
data/lib/action_dispatch/testing/assertions/response.rb +2 -7
data/lib/action_dispatch/testing/assertions/routing.rb +9 -9
data/lib/action_dispatch/testing/assertions/selector.rb +2 -429
data/lib/action_dispatch/testing/assertions/tag.rb +2 -134
data/lib/action_dispatch/testing/integration.rb +15 -18
data/lib/action_dispatch/testing/test_request.rb +1 -1
data/lib/action_dispatch/testing/test_response.rb +5 -1
data/lib/action_pack/gem_version.rb +3 -3
metadata +57 -15
data/lib/action_controller/metal/responder.rb +0 -297

data/lib/action_controller/metal/redirecting.rb CHANGED

@@ -14,7 +14,7 @@ module ActionController
     include ActionController::RackDelegation
     include ActionController::UrlFor
-    # Redirects the browser to the target specified in +options+. This parameter can take one of three forms:
+    # Redirects the browser to the target specified in +options+. This parameter can be any one of:
     #
     # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
     # * <tt>Record</tt> - The URL will be generated by calling url_for with the +options+, which will reference a named URL for that record.
@@ -24,6 +24,8 @@ module ActionController
     # * <tt>:back</tt> - Back to the page that issued the request. Useful for forms that are triggered from multiple places.
     #   Short-hand for <tt>redirect_to(request.env["HTTP_REFERER"])</tt>
     #
+    # === Examples:
+    #
     #   redirect_to action: "show", id: 5
     #   redirect_to post
     #   redirect_to "http://www.rubyonrails.org"
@@ -32,7 +34,7 @@ module ActionController
     #   redirect_to :back
     #   redirect_to proc { edit_post_url(@post) }
     #
-    # The redirection happens as a "302 Found" header unless otherwise specified.
+    # The redirection happens as a "302 Found" header unless otherwise specified using the <tt>:status</tt> option:
     #
     #   redirect_to post_url(@post), status: :found
     #   redirect_to action: 'atom', status: :moved_permanently
@@ -60,19 +62,21 @@ module ActionController
     #   redirect_to post_url(@post), status: 301, flash: { updated_post_id: @post.id }
     #   redirect_to({ action: 'atom' }, alert: "Something serious happened")
     #
-    # When using <tt>redirect_to :back</tt>, if there is no referrer, ActionController::RedirectBackError will be raised. You may specify some fallback
-    # behavior for this case by rescuing ActionController::RedirectBackError.
+    # When using <tt>redirect_to :back</tt>, if there is no referrer,
+    # <tt>ActionController::RedirectBackError</tt> will be raised. You
+    # may specify some fallback behavior for this case by rescuing
+    # <tt>ActionController::RedirectBackError</tt>.
     def redirect_to(options = {}, response_status = {}) #:doc:
       raise ActionControllerError.new("Cannot redirect to nil!") unless options
       raise ActionControllerError.new("Cannot redirect to a parameter hash!") if options.is_a?(ActionController::Parameters)
       raise AbstractController::DoubleRenderError if response_body
       self.status        = _extract_redirect_to_status(options, response_status)
-      self.location      = _compute_redirect_to_location(options)
-      self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.h(location)}\">redirected</a>.</body></html>"
+      self.location      = _compute_redirect_to_location(request, options)
+      self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(location)}\">redirected</a>.</body></html>"
     end
-    def _compute_redirect_to_location(options) #:nodoc:
+    def _compute_redirect_to_location(request, options) #:nodoc:
       case options
       # The scheme name consist of a letter followed by any combination of
       # letters, digits, and the plus ("+"), period ("."), or hyphen ("-")
@@ -86,11 +90,13 @@ module ActionController
       when :back
         request.headers["Referer"] or raise RedirectBackError
       when Proc
-        _compute_redirect_to_location options.call
+        _compute_redirect_to_location request, options.call
       else
         url_for(options)
       end.delete("\0\r\n")
     end
+    module_function :_compute_redirect_to_location
+    public :_compute_redirect_to_location
     private
       def _extract_redirect_to_status(options, response_status)

data/lib/action_controller/metal/renderers.rb CHANGED

@@ -6,6 +6,11 @@ module ActionController
     Renderers.add(key, &block)
   end
+  # See <tt>Renderers.remove</tt>
+  def self.remove_renderer(key)
+    Renderers.remove(key)
+  end
   class MissingRenderer < LoadError
     def initialize(format)
       super "No renderer defined for format: #{format}"
@@ -42,8 +47,8 @@ module ActionController
       nil
     end
-    # Hash of available renderers, mapping a renderer name to its proc.
-    # Default keys are <tt>:json</tt>, <tt>:js</tt>, <tt>:xml</tt>.
+    # A Set containing renderer names that correspond to available renderer procs.
+    # Default values are <tt>:json</tt>, <tt>:js</tt>, <tt>:xml</tt>.
     RENDERERS = Set.new
     # Adds a new renderer to call within controller actions.
@@ -73,7 +78,7 @@ module ActionController
     #     respond_to do |format|
     #       format.html
     #       format.csv { render csv: @csvable, filename: @csvable.name }
-    #     }
+    #     end
     #   end
     # To use renderers and their mime types in more concise ways, see
     # <tt>ActionController::MimeResponds::ClassMethods.respond_to</tt> and
@@ -83,6 +88,17 @@ module ActionController
       RENDERERS << key.to_sym
     end
+    # This method is the opposite of add method.
+    #
+    # Usage:
+    #
+    #   ActionController::Renderers.remove(:csv)
+    def self.remove(key)
+      RENDERERS.delete(key.to_sym)
+      method = "_render_option_#{key}"
+      remove_method(method) if method_defined?(method)
+    end
     module All
       extend ActiveSupport::Concern
       include Renderers

data/lib/action_controller/metal/rendering.rb CHANGED

@@ -67,8 +67,8 @@ module ActionController
         options[:html] = ERB::Util.html_escape(options[:html])
       end
-      if options.delete(:nothing) || _any_render_format_is_nil?(options)
-        options[:body] = " "
+      if options.delete(:nothing)
+        options[:body] = nil
       end
       if options[:status]
@@ -86,10 +86,6 @@ module ActionController
       end
     end
-    def _any_render_format_is_nil?(options)
-      RENDER_FORMATS_IN_PRIORITY.any? { |format| options.key?(format) && options[format].nil? }
-    end
     # Process controller specific options, as status, content-type and location.
     def _process_options(options) #:nodoc:
       status, content_type, location = options.values_at(:status, :content_type, :location)

data/lib/action_controller/metal/request_forgery_protection.rb CHANGED

@@ -9,7 +9,7 @@ module ActionController #:nodoc:
   end
   # Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks
-  # by including a token in the rendered html for your application. This token is
+  # by including a token in the rendered HTML for your application. This token is
   # stored as a random string in the session, to which an attacker does not have
   # access. When a request reaches your application, \Rails verifies the received
   # token with the token in the session. Only HTML and JavaScript requests are checked,
@@ -44,7 +44,7 @@ module ActionController #:nodoc:
   #
   # The token parameter is named <tt>authenticity_token</tt> by default. The name and
   # value of this token must be added to every layout that renders forms by including
-  # <tt>csrf_meta_tags</tt> in the html +head+.
+  # <tt>csrf_meta_tags</tt> in the HTML +head+.
   #
   # Learn more about CSRF attacks and securing your application in the
   # {Ruby on Rails Security Guide}[http://guides.rubyonrails.org/security.html].
@@ -68,12 +68,16 @@ module ActionController #:nodoc:
       config_accessor :allow_forgery_protection
       self.allow_forgery_protection = true if allow_forgery_protection.nil?
+      # Controls whether a CSRF failure logs a warning. On by default.
+      config_accessor :log_warning_on_csrf_failure
+      self.log_warning_on_csrf_failure = true
       helper_method :form_authenticity_token
       helper_method :protect_against_forgery?
     end
     module ClassMethods
-      # Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.
+      # Turn on request forgery protection. Bear in mind that GET and HEAD requests are not checked.
       #
       #   class ApplicationController < ActionController::Base
       #     protect_from_forgery
@@ -193,7 +197,9 @@ module ActionController #:nodoc:
         mark_for_same_origin_verification!
         if !verified_request?
-          logger.warn "Can't verify CSRF token authenticity" if logger
+          if logger && log_warning_on_csrf_failure
+            logger.warn "Can't verify CSRF token authenticity"
+          end
           handle_unverified_request
         end
       end
@@ -234,6 +240,8 @@ module ActionController #:nodoc:
         content_type =~ %r(\Atext/javascript) && !request.xhr?
       end
+      AUTHENTICITY_TOKEN_LENGTH = 32
       # Returns true or false if a request is verified. Checks:
       #
       # * is it a GET or HEAD request?  Gets should be safe and idempotent
@@ -241,13 +249,73 @@ module ActionController #:nodoc:
       # * Does the X-CSRF-Token header match the form_authenticity_token
       def verified_request?
         !protect_against_forgery? || request.get? || request.head? ||
-          form_authenticity_token == params[request_forgery_protection_token] ||
-          form_authenticity_token == request.headers['X-CSRF-Token']
+          valid_authenticity_token?(session, form_authenticity_param) ||
+          valid_authenticity_token?(session, request.headers['X-CSRF-Token'])
       end
       # Sets the token value for the current session.
       def form_authenticity_token
-        session[:_csrf_token] ||= SecureRandom.base64(32)
+        masked_authenticity_token(session)
+      end
+      # Creates a masked version of the authenticity token that varies
+      # on each request. The masking is used to mitigate SSL attacks
+      # like BREACH.
+      def masked_authenticity_token(session)
+        one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
+        encrypted_csrf_token = xor_byte_strings(one_time_pad, real_csrf_token(session))
+        masked_token = one_time_pad + encrypted_csrf_token
+        Base64.strict_encode64(masked_token)
+      end
+      # Checks the client's masked token to see if it matches the
+      # session token. Essentially the inverse of
+      # +masked_authenticity_token+.
+      def valid_authenticity_token?(session, encoded_masked_token)
+        return false if encoded_masked_token.nil? || encoded_masked_token.empty?
+        begin
+          masked_token = Base64.strict_decode64(encoded_masked_token)
+        rescue ArgumentError # encoded_masked_token is invalid Base64
+          return false
+        end
+        # See if it's actually a masked token or not. In order to
+        # deploy this code, we should be able to handle any unmasked
+        # tokens that we've issued without error.
+        if masked_token.length == AUTHENTICITY_TOKEN_LENGTH
+          # This is actually an unmasked token. This is expected if
+          # you have just upgraded to masked tokens, but should stop
+          # happening shortly after installing this gem
+          compare_with_real_token masked_token, session
+        elsif masked_token.length == AUTHENTICITY_TOKEN_LENGTH * 2
+          # Split the token into the one-time pad and the encrypted
+          # value and decrypt it
+          one_time_pad = masked_token[0...AUTHENTICITY_TOKEN_LENGTH]
+          encrypted_csrf_token = masked_token[AUTHENTICITY_TOKEN_LENGTH..-1]
+          csrf_token = xor_byte_strings(one_time_pad, encrypted_csrf_token)
+          compare_with_real_token csrf_token, session
+        else
+          false # Token is malformed
+        end
+      end
+      def compare_with_real_token(token, session)
+        # Borrow a constant-time comparison from Rack
+        Rack::Utils.secure_compare(token, real_csrf_token(session))
+      end
+      def real_csrf_token(session)
+        session[:_csrf_token] ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
+        Base64.strict_decode64(session[:_csrf_token])
+      end
+      def xor_byte_strings(s1, s2)
+        s1.bytes.zip(s2.bytes).map { |(c1,c2)| c1 ^ c2 }.pack('c*')
       end
       # The form's authenticity parameter. Override to provide your own.

data/lib/action_controller/metal/streaming.rb CHANGED

@@ -183,7 +183,7 @@ module ActionController #:nodoc:
   # You may also want to configure other parameters like <tt>:tcp_nodelay</tt>.
   # Please check its documentation for more information: http://unicorn.bogomips.org/Unicorn/Configurator.html#method-i-listen
   #
-  # If you are using Unicorn with Nginx, you may need to tweak Nginx.
+  # If you are using Unicorn with NGINX, you may need to tweak NGINX.
   # Streaming should work out of the box on Rainbows.
   #
   # ==== Passenger

data/lib/action_controller/metal/strong_parameters.rb CHANGED

@@ -1,5 +1,6 @@
 require 'active_support/core_ext/hash/indifferent_access'
 require 'active_support/core_ext/array/wrap'
+require 'active_support/deprecation'
 require 'active_support/rescuable'
 require 'action_dispatch/http/upload'
 require 'stringio'
@@ -32,14 +33,14 @@ module ActionController
     def initialize(params) # :nodoc:
       @params = params
-      super("found unpermitted parameters: #{params.join(", ")}")
+      super("found unpermitted parameter#{'s' if params.size > 1 }: #{params.join(", ")}")
     end
   end
   # == Action Controller \Parameters
   #
   # Allows to choose which attributes should be whitelisted for mass updating
-  # and thus prevent accidentally exposing that which shouldn’t be exposed.
+  # and thus prevent accidentally exposing that which shouldn't be exposed.
   # Provides two methods for this purpose: #require and #permit. The former is
   # used to mark parameters as required. The latter is used to set the parameter
   # as permitted and limit which attributes should be allowed for mass updating.
@@ -101,9 +102,23 @@ module ActionController
     cattr_accessor :permit_all_parameters, instance_accessor: false
     cattr_accessor :action_on_unpermitted_parameters, instance_accessor: false
-    # Never raise an UnpermittedParameters exception because of these params
-    # are present. They are added by Rails and it's of no concern.
-    NEVER_UNPERMITTED_PARAMS = %w( controller action )
+    # By default, never raise an UnpermittedParameters exception if these
+    # params are present. The default includes both 'controller' and 'action'
+    # because they are added by Rails and should be of no concern. One way
+    # to change these is to specify `always_permitted_parameters` in your
+    # config. For instance:
+    #
+    #    config.always_permitted_parameters = %w( controller action format )
+    cattr_accessor :always_permitted_parameters
+    self.always_permitted_parameters = %w( controller action )
+    def self.const_missing(const_name)
+      super unless const_name == :NEVER_UNPERMITTED_PARAMS
+      ActiveSupport::Deprecation.warn "`ActionController::Parameters::NEVER_UNPERMITTED_PARAMS`"\
+                                      " has been deprecated. Use "\
+                                      "`ActionController::Parameters.always_permitted_parameters` instead."
+      self.always_permitted_parameters
+    end
     # Returns a new instance of <tt>ActionController::Parameters</tt>.
     # Also, sets the +permitted+ attribute to the default value of
@@ -126,9 +141,44 @@ module ActionController
       @permitted = self.class.permit_all_parameters
     end
+    # Returns a safe +Hash+ representation of this parameter with all
+    # unpermitted keys removed.
+    #
+    #   params = ActionController::Parameters.new({
+    #     name: 'Senjougahara Hitagi',
+    #     oddity: 'Heavy stone crab'
+    #   })
+    #   params.to_h # => {}
+    #
+    #   safe_params = params.permit(:name)
+    #   safe_params.to_h # => {"name"=>"Senjougahara Hitagi"}
+    def to_h
+      if permitted?
+        to_hash
+      else
+        slice(*self.class.always_permitted_parameters).permit!.to_h
+      end
+    end
+    # Convert all hashes in values into parameters, then yield each pair like
+    # the same way as <tt>Hash#each_pair</tt>
+    def each_pair(&block)
+      super do |key, value|
+        convert_hashes_to_parameters(key, value)
+      end
+      super
+    end
+    alias_method :each, :each_pair
     # Attribute that keeps track of converted arrays, if any, to avoid double
     # looping in the common use case permit + mass-assignment. Defined in a
     # method to instantiate it only if needed.
+    #
+    # Testing membership still loops, but it's going to be faster than our own
+    # loop that converts values. Also, we are not going to build a new array
+    # object per fetch.
     def converted_arrays
       @converted_arrays ||= Set.new
     end
@@ -157,9 +207,8 @@ module ActionController
     #   Person.new(params) # => #<Person id: nil, name: "Francesco">
     def permit!
       each_pair do |key, value|
-        value = convert_hashes_to_parameters(key, value)
-        Array.wrap(value).each do |_|
-          _.permit! if _.respond_to? :permit!
+        Array.wrap(value).each do |v|
+          v.permit! if v.respond_to? :permit!
         end
       end
@@ -312,11 +361,56 @@ module ActionController
     #   params.slice(:a, :b) # => {"a"=>1, "b"=>2}
     #   params.slice(:d)     # => {}
     def slice(*keys)
-      self.class.new(super).tap do |new_instance|
-        new_instance.permitted = @permitted
+      new_instance_with_inherited_permitted_status(super)
+    end
+    # Removes and returns the key/value pairs matching the given keys.
+    #
+    #   params = ActionController::Parameters.new(a: 1, b: 2, c: 3)
+    #   params.extract!(:a, :b) # => {"a"=>1, "b"=>2}
+    #   params                  # => {"c"=>3}
+    def extract!(*keys)
+      new_instance_with_inherited_permitted_status(super)
+    end
+    # Returns a new <tt>ActionController::Parameters</tt> with the results of
+    # running +block+ once for every value. The keys are unchanged.
+    #
+    #   params = ActionController::Parameters.new(a: 1, b: 2, c: 3)
+    #   params.transform_values { |x| x * 2 }
+    #   # => {"a"=>2, "b"=>4, "c"=>6}
+    def transform_values
+      if block_given?
+        new_instance_with_inherited_permitted_status(super)
+      else
+        super
+      end
+    end
+    # This method is here only to make sure that the returned object has the
+    # correct +permitted+ status. It should not matter since the parent of
+    # this object is +HashWithIndifferentAccess+
+    def transform_keys # :nodoc:
+      if block_given?
+        new_instance_with_inherited_permitted_status(super)
+      else
+        super
       end
     end
+    # Deletes and returns a key-value pair from +Parameters+ whose key is equal
+    # to key. If the key is not found, returns the default value. If the
+    # optional code block is given and the key is not found, pass in the key
+    # and return the result of block.
+    def delete(key, &block)
+      convert_hashes_to_parameters(key, super, false)
+    end
+    # Equivalent to Hash#keep_if, but returns nil if no changes were made.
+    def select!(&block)
+      convert_value_to_parameters(super)
+    end
     # Returns an exact copy of the <tt>ActionController::Parameters</tt>
     # instance. +permitted+ state is kept on the duped object.
     #
@@ -337,6 +431,12 @@ module ActionController
       end
     private
+      def new_instance_with_inherited_permitted_status(hash)
+        self.class.new(hash).tap do |new_instance|
+          new_instance.permitted = @permitted
+        end
+      end
       def convert_hashes_to_parameters(key, value, assign_if_converted=true)
         converted = convert_value_to_parameters(value)
         self[key] = converted if assign_if_converted && !converted.equal?(value)
@@ -385,7 +485,7 @@ module ActionController
       end
       def unpermitted_keys(params)
-        self.keys - params.keys - NEVER_UNPERMITTED_PARAMS
+        self.keys - params.keys - self.always_permitted_parameters
       end
       #