RubyGems - actionpack - Versions diffs - 4.1.7 → 4.2.1 - Mend

actionpack 4.1.7 → 4.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (106) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +311 -527
data/README.rdoc +7 -2
data/lib/abstract_controller/base.rb +16 -6
data/lib/abstract_controller/callbacks.rb +28 -51
data/lib/abstract_controller/helpers.rb +11 -4
data/lib/abstract_controller/railties/routes_helpers.rb +3 -3
data/lib/abstract_controller/url_for.rb +1 -1
data/lib/action_controller/base.rb +2 -1
data/lib/action_controller/caching/fragments.rb +7 -1
data/lib/action_controller/caching.rb +1 -1
data/lib/action_controller/log_subscriber.rb +26 -26
data/lib/action_controller/metal/conditional_get.rb +37 -12
data/lib/action_controller/metal/etag_with_template_digest.rb +50 -0
data/lib/action_controller/metal/exceptions.rb +1 -1
data/lib/action_controller/metal/force_ssl.rb +1 -1
data/lib/action_controller/metal/head.rb +7 -3
data/lib/action_controller/metal/http_authentication.rb +14 -9
data/lib/action_controller/metal/instrumentation.rb +8 -5
data/lib/action_controller/metal/live.rb +57 -6
data/lib/action_controller/metal/mime_responds.rb +23 -246
data/lib/action_controller/metal/params_wrapper.rb +2 -2
data/lib/action_controller/metal/rack_delegation.rb +1 -1
data/lib/action_controller/metal/redirecting.rb +14 -8
data/lib/action_controller/metal/renderers.rb +30 -10
data/lib/action_controller/metal/rendering.rb +2 -6
data/lib/action_controller/metal/request_forgery_protection.rb +78 -7
data/lib/action_controller/metal/streaming.rb +1 -1
data/lib/action_controller/metal/strong_parameters.rb +125 -12
data/lib/action_controller/metal/url_for.rb +11 -12
data/lib/action_controller/metal.rb +12 -11
data/lib/action_controller/model_naming.rb +1 -1
data/lib/action_controller/railtie.rb +4 -0
data/lib/action_controller/test_case.rb +112 -75
data/lib/action_controller.rb +1 -1
data/lib/action_dispatch/http/cache.rb +5 -4
data/lib/action_dispatch/http/filter_parameters.rb +2 -2
data/lib/action_dispatch/http/headers.rb +43 -9
data/lib/action_dispatch/http/mime_negotiation.rb +10 -3
data/lib/action_dispatch/http/mime_type.rb +2 -2
data/lib/action_dispatch/http/parameter_filter.rb +1 -1
data/lib/action_dispatch/http/parameters.rb +11 -26
data/lib/action_dispatch/http/request.rb +37 -11
data/lib/action_dispatch/http/response.rb +70 -18
data/lib/action_dispatch/http/upload.rb +3 -8
data/lib/action_dispatch/http/url.rb +88 -69
data/lib/action_dispatch/journey/formatter.rb +33 -17
data/lib/action_dispatch/journey/gtg/builder.rb +3 -3
data/lib/action_dispatch/journey/gtg/simulator.rb +10 -7
data/lib/action_dispatch/journey/gtg/transition_table.rb +20 -28
data/lib/action_dispatch/journey/nfa/dot.rb +2 -2
data/lib/action_dispatch/journey/nfa/simulator.rb +1 -1
data/lib/action_dispatch/journey/nfa/transition_table.rb +5 -5
data/lib/action_dispatch/journey/nodes/node.rb +4 -0
data/lib/action_dispatch/journey/parser.rb +52 -60
data/lib/action_dispatch/journey/parser.y +11 -10
data/lib/action_dispatch/journey/path/pattern.rb +16 -19
data/lib/action_dispatch/journey/route.rb +3 -18
data/lib/action_dispatch/journey/router/strexp.rb +9 -6
data/lib/action_dispatch/journey/router.rb +53 -77
data/lib/action_dispatch/journey/scanner.rb +5 -5
data/lib/action_dispatch/journey/visitors.rb +81 -92
data/lib/action_dispatch/journey/visualizer/fsm.css +0 -4
data/lib/action_dispatch/journey/visualizer/index.html.erb +2 -2
data/lib/action_dispatch/middleware/callbacks.rb +1 -1
data/lib/action_dispatch/middleware/cookies.rb +29 -29
data/lib/action_dispatch/middleware/debug_exceptions.rb +15 -4
data/lib/action_dispatch/middleware/exception_wrapper.rb +50 -18
data/lib/action_dispatch/middleware/flash.rb +13 -7
data/lib/action_dispatch/middleware/params_parser.rb +1 -1
data/lib/action_dispatch/middleware/public_exceptions.rb +12 -3
data/lib/action_dispatch/middleware/remote_ip.rb +40 -54
data/lib/action_dispatch/middleware/request_id.rb +1 -1
data/lib/action_dispatch/middleware/session/cookie_store.rb +1 -1
data/lib/action_dispatch/middleware/show_exceptions.rb +1 -0
data/lib/action_dispatch/middleware/static.rb +66 -37
data/lib/action_dispatch/middleware/templates/rescues/_source.erb +21 -19
data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +37 -9
data/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb +2 -8
data/lib/action_dispatch/middleware/templates/rescues/{diagnostics.erb → diagnostics.html.erb} +0 -0
data/lib/action_dispatch/middleware/templates/rescues/diagnostics.text.erb +9 -0
data/lib/action_dispatch/middleware/templates/rescues/layout.erb +6 -0
data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +4 -0
data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +2 -0
data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +1 -24
data/lib/action_dispatch/middleware/templates/rescues/template_error.text.erb +0 -1
data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +120 -64
data/lib/action_dispatch/routing/endpoint.rb +10 -0
data/lib/action_dispatch/routing/inspector.rb +5 -12
data/lib/action_dispatch/routing/mapper.rb +410 -281
data/lib/action_dispatch/routing/polymorphic_routes.rb +191 -79
data/lib/action_dispatch/routing/redirection.rb +10 -12
data/lib/action_dispatch/routing/route_set.rb +297 -168
data/lib/action_dispatch/routing/url_for.rb +15 -4
data/lib/action_dispatch/testing/assertions/dom.rb +2 -26
data/lib/action_dispatch/testing/assertions/response.rb +2 -7
data/lib/action_dispatch/testing/assertions/routing.rb +22 -22
data/lib/action_dispatch/testing/assertions/selector.rb +2 -429
data/lib/action_dispatch/testing/assertions/tag.rb +2 -134
data/lib/action_dispatch/testing/assertions.rb +11 -7
data/lib/action_dispatch/testing/integration.rb +24 -19
data/lib/action_dispatch/testing/test_request.rb +1 -1
data/lib/action_dispatch/testing/test_response.rb +7 -0
data/lib/action_pack/gem_version.rb +3 -3
metadata +55 -13
data/lib/action_controller/metal/responder.rb +0 -297

data/lib/action_controller/metal/params_wrapper.rb CHANGED Viewed

@@ -244,7 +244,7 @@ module ActionController
         request.parameters.merge! wrapped_hash
         request.request_parameters.merge! wrapped_hash
-        # This will make the wrapped hash displayed in the log file
+        # This will display the wrapped hash in the log file
         request.filtered_parameters.merge! wrapped_filtered_hash
       end
       super
@@ -252,7 +252,7 @@ module ActionController
     private
-      # Returns the wrapper key which will use to stored wrapped parameters.
+      # Returns the wrapper key which will be used to stored wrapped parameters.
       def _wrapper_key
         _wrapper_options.name
       end

data/lib/action_controller/metal/rack_delegation.rb CHANGED Viewed

@@ -6,7 +6,7 @@ module ActionController
     extend ActiveSupport::Concern
     delegate :headers, :status=, :location=, :content_type=,
-             :status, :location, :content_type, :_status_code, :to => "@_response"
+             :status, :location, :content_type, :response_code, :to => "@_response"
     def dispatch(action, request)
       set_response!(request)

data/lib/action_controller/metal/redirecting.rb CHANGED Viewed

@@ -14,7 +14,7 @@ module ActionController
     include ActionController::RackDelegation
     include ActionController::UrlFor
-    # Redirects the browser to the target specified in +options+. This parameter can take one of three forms:
+    # Redirects the browser to the target specified in +options+. This parameter can be any one of:
     #
     # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
     # * <tt>Record</tt> - The URL will be generated by calling url_for with the +options+, which will reference a named URL for that record.
@@ -24,6 +24,8 @@ module ActionController
     # * <tt>:back</tt> - Back to the page that issued the request. Useful for forms that are triggered from multiple places.
     #   Short-hand for <tt>redirect_to(request.env["HTTP_REFERER"])</tt>
     #
+    # === Examples:
+    #
     #   redirect_to action: "show", id: 5
     #   redirect_to post
     #   redirect_to "http://www.rubyonrails.org"
@@ -32,7 +34,7 @@ module ActionController
     #   redirect_to :back
     #   redirect_to proc { edit_post_url(@post) }
     #
-    # The redirection happens as a "302 Found" header unless otherwise specified.
+    # The redirection happens as a "302 Found" header unless otherwise specified using the <tt>:status</tt> option:
     #
     #   redirect_to post_url(@post), status: :found
     #   redirect_to action: 'atom', status: :moved_permanently
@@ -60,19 +62,21 @@ module ActionController
     #   redirect_to post_url(@post), status: 301, flash: { updated_post_id: @post.id }
     #   redirect_to({ action: 'atom' }, alert: "Something serious happened")
     #
-    # When using <tt>redirect_to :back</tt>, if there is no referrer, ActionController::RedirectBackError will be raised. You may specify some fallback
-    # behavior for this case by rescuing ActionController::RedirectBackError.
+    # When using <tt>redirect_to :back</tt>, if there is no referrer,
+    # <tt>ActionController::RedirectBackError</tt> will be raised. You
+    # may specify some fallback behavior for this case by rescuing
+    # <tt>ActionController::RedirectBackError</tt>.
     def redirect_to(options = {}, response_status = {}) #:doc:
       raise ActionControllerError.new("Cannot redirect to nil!") unless options
       raise ActionControllerError.new("Cannot redirect to a parameter hash!") if options.is_a?(ActionController::Parameters)
       raise AbstractController::DoubleRenderError if response_body
       self.status        = _extract_redirect_to_status(options, response_status)
-      self.location      = _compute_redirect_to_location(options)
-      self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.h(location)}\">redirected</a>.</body></html>"
+      self.location      = _compute_redirect_to_location(request, options)
+      self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(location)}\">redirected</a>.</body></html>"
     end
-    def _compute_redirect_to_location(options) #:nodoc:
+    def _compute_redirect_to_location(request, options) #:nodoc:
       case options
       # The scheme name consist of a letter followed by any combination of
       # letters, digits, and the plus ("+"), period ("."), or hyphen ("-")
@@ -86,11 +90,13 @@ module ActionController
       when :back
         request.headers["Referer"] or raise RedirectBackError
       when Proc
-        _compute_redirect_to_location options.call
+        _compute_redirect_to_location request, options.call
       else
         url_for(options)
       end.delete("\0\r\n")
     end
+    module_function :_compute_redirect_to_location
+    public :_compute_redirect_to_location
     private
       def _extract_redirect_to_status(options, response_status)

data/lib/action_controller/metal/renderers.rb CHANGED Viewed

@@ -6,6 +6,11 @@ module ActionController
     Renderers.add(key, &block)
   end
+  # See <tt>Renderers.remove</tt>
+  def self.remove_renderer(key)
+    Renderers.remove(key)
+  end
   class MissingRenderer < LoadError
     def initialize(format)
       super "No renderer defined for format: #{format}"
@@ -29,23 +34,28 @@ module ActionController
     end
     def render_to_body(options)
-      _handle_render_options(options) || super
+      _render_to_body_with_renderer(options) || super
     end
-    def _handle_render_options(options)
+    def _render_to_body_with_renderer(options)
       _renderers.each do |name|
         if options.key?(name)
           _process_options(options)
-          return send("_render_option_#{name}", options.delete(name), options)
+          method_name = Renderers._render_with_renderer_method_name(name)
+          return send(method_name, options.delete(name), options)
         end
       end
       nil
     end
-    # Hash of available renderers, mapping a renderer name to its proc.
-    # Default keys are <tt>:json</tt>, <tt>:js</tt>, <tt>:xml</tt>.
+    # A Set containing renderer names that correspond to available renderer procs.
+    # Default values are <tt>:json</tt>, <tt>:js</tt>, <tt>:xml</tt>.
     RENDERERS = Set.new
+    def self._render_with_renderer_method_name(key)
+      "_render_with_renderer_#{key}"
+    end
     # Adds a new renderer to call within controller actions.
     # A renderer is invoked by passing its name as an option to
     # <tt>AbstractController::Rendering#render</tt>. To create a renderer
@@ -73,16 +83,26 @@ module ActionController
     #     respond_to do |format|
     #       format.html
     #       format.csv { render csv: @csvable, filename: @csvable.name }
-    #     }
+    #     end
     #   end
     # To use renderers and their mime types in more concise ways, see
-    # <tt>ActionController::MimeResponds::ClassMethods.respond_to</tt> and
-    # <tt>ActionController::MimeResponds#respond_with</tt>
+    # <tt>ActionController::MimeResponds::ClassMethods.respond_to</tt>
     def self.add(key, &block)
-      define_method("_render_option_#{key}", &block)
+      define_method(_render_with_renderer_method_name(key), &block)
       RENDERERS << key.to_sym
     end
+    # This method is the opposite of add method.
+    #
+    # Usage:
+    #
+    #   ActionController::Renderers.remove(:csv)
+    def self.remove(key)
+      RENDERERS.delete(key.to_sym)
+      method_name = _render_with_renderer_method_name(key)
+      remove_method(method_name) if method_defined?(method_name)
+    end
     module All
       extend ActiveSupport::Concern
       include Renderers
@@ -96,7 +116,7 @@ module ActionController
       json = json.to_json(options) unless json.kind_of?(String)
       if options[:callback].present?
-        if self.content_type.nil? || self.content_type == Mime::JSON
+        if content_type.nil? || content_type == Mime::JSON
           self.content_type = Mime::JS
         end

data/lib/action_controller/metal/rendering.rb CHANGED Viewed

@@ -67,8 +67,8 @@ module ActionController
         options[:html] = ERB::Util.html_escape(options[:html])
       end
-      if options.delete(:nothing) || _any_render_format_is_nil?(options)
-        options[:body] = " "
+      if options.delete(:nothing)
+        options[:body] = nil
       end
       if options[:status]
@@ -86,10 +86,6 @@ module ActionController
       end
     end
-    def _any_render_format_is_nil?(options)
-      RENDER_FORMATS_IN_PRIORITY.any? { |format| options.key?(format) && options[format].nil? }
-    end
     # Process controller specific options, as status, content-type and location.
     def _process_options(options) #:nodoc:
       status, content_type, location = options.values_at(:status, :content_type, :location)

data/lib/action_controller/metal/request_forgery_protection.rb CHANGED Viewed

@@ -1,5 +1,6 @@
 require 'rack/session/abstract/id'
 require 'action_controller/metal/exceptions'
+require 'active_support/security_utils'
 module ActionController #:nodoc:
   class InvalidAuthenticityToken < ActionControllerError #:nodoc:
@@ -9,7 +10,7 @@ module ActionController #:nodoc:
   end
   # Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks
-  # by including a token in the rendered html for your application. This token is
+  # by including a token in the rendered HTML for your application. This token is
   # stored as a random string in the session, to which an attacker does not have
   # access. When a request reaches your application, \Rails verifies the received
   # token with the token in the session. Only HTML and JavaScript requests are checked,
@@ -44,7 +45,7 @@ module ActionController #:nodoc:
   #
   # The token parameter is named <tt>authenticity_token</tt> by default. The name and
   # value of this token must be added to every layout that renders forms by including
-  # <tt>csrf_meta_tags</tt> in the html +head+.
+  # <tt>csrf_meta_tags</tt> in the HTML +head+.
   #
   # Learn more about CSRF attacks and securing your application in the
   # {Ruby on Rails Security Guide}[http://guides.rubyonrails.org/security.html].
@@ -68,12 +69,16 @@ module ActionController #:nodoc:
       config_accessor :allow_forgery_protection
       self.allow_forgery_protection = true if allow_forgery_protection.nil?
+      # Controls whether a CSRF failure logs a warning. On by default.
+      config_accessor :log_warning_on_csrf_failure
+      self.log_warning_on_csrf_failure = true
       helper_method :form_authenticity_token
       helper_method :protect_against_forgery?
     end
     module ClassMethods
-      # Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.
+      # Turn on request forgery protection. Bear in mind that GET and HEAD requests are not checked.
       #
       #   class ApplicationController < ActionController::Base
       #     protect_from_forgery
@@ -193,7 +198,9 @@ module ActionController #:nodoc:
         mark_for_same_origin_verification!
         if !verified_request?
-          logger.warn "Can't verify CSRF token authenticity" if logger
+          if logger && log_warning_on_csrf_failure
+            logger.warn "Can't verify CSRF token authenticity"
+          end
           handle_unverified_request
         end
       end
@@ -202,6 +209,7 @@ module ActionController #:nodoc:
         forgery_protection_strategy.new(self).handle_unverified_request
       end
+      #:nodoc:
       CROSS_ORIGIN_JAVASCRIPT_WARNING = "Security warning: an embedded " \
         "<script> tag on another site requested protected JavaScript. " \
         "If you know what you're doing, go ahead and disable forgery " \
@@ -234,6 +242,8 @@ module ActionController #:nodoc:
         content_type =~ %r(\Atext/javascript) && !request.xhr?
       end
+      AUTHENTICITY_TOKEN_LENGTH = 32
       # Returns true or false if a request is verified. Checks:
       #
       # * is it a GET or HEAD request?  Gets should be safe and idempotent
@@ -241,13 +251,74 @@ module ActionController #:nodoc:
       # * Does the X-CSRF-Token header match the form_authenticity_token
       def verified_request?
         !protect_against_forgery? || request.get? || request.head? ||
-          form_authenticity_token == params[request_forgery_protection_token] ||
-          form_authenticity_token == request.headers['X-CSRF-Token']
+          valid_authenticity_token?(session, form_authenticity_param) ||
+          valid_authenticity_token?(session, request.headers['X-CSRF-Token'])
       end
       # Sets the token value for the current session.
       def form_authenticity_token
-        session[:_csrf_token] ||= SecureRandom.base64(32)
+        masked_authenticity_token(session)
+      end
+      # Creates a masked version of the authenticity token that varies
+      # on each request. The masking is used to mitigate SSL attacks
+      # like BREACH.
+      def masked_authenticity_token(session)
+        one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
+        encrypted_csrf_token = xor_byte_strings(one_time_pad, real_csrf_token(session))
+        masked_token = one_time_pad + encrypted_csrf_token
+        Base64.strict_encode64(masked_token)
+      end
+      # Checks the client's masked token to see if it matches the
+      # session token. Essentially the inverse of
+      # +masked_authenticity_token+.
+      def valid_authenticity_token?(session, encoded_masked_token)
+        if encoded_masked_token.nil? || encoded_masked_token.empty? || !encoded_masked_token.is_a?(String)
+          return false
+        end
+        begin
+          masked_token = Base64.strict_decode64(encoded_masked_token)
+        rescue ArgumentError # encoded_masked_token is invalid Base64
+          return false
+        end
+        # See if it's actually a masked token or not. In order to
+        # deploy this code, we should be able to handle any unmasked
+        # tokens that we've issued without error.
+        if masked_token.length == AUTHENTICITY_TOKEN_LENGTH
+          # This is actually an unmasked token. This is expected if
+          # you have just upgraded to masked tokens, but should stop
+          # happening shortly after installing this gem
+          compare_with_real_token masked_token, session
+        elsif masked_token.length == AUTHENTICITY_TOKEN_LENGTH * 2
+          # Split the token into the one-time pad and the encrypted
+          # value and decrypt it
+          one_time_pad = masked_token[0...AUTHENTICITY_TOKEN_LENGTH]
+          encrypted_csrf_token = masked_token[AUTHENTICITY_TOKEN_LENGTH..-1]
+          csrf_token = xor_byte_strings(one_time_pad, encrypted_csrf_token)
+          compare_with_real_token csrf_token, session
+        else
+          false # Token is malformed
+        end
+      end
+      def compare_with_real_token(token, session)
+        ActiveSupport::SecurityUtils.secure_compare(token, real_csrf_token(session))
+      end
+      def real_csrf_token(session)
+        session[:_csrf_token] ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
+        Base64.strict_decode64(session[:_csrf_token])
+      end
+      def xor_byte_strings(s1, s2)
+        s1.bytes.zip(s2.bytes).map { |(c1,c2)| c1 ^ c2 }.pack('c*')
       end
       # The form's authenticity parameter. Override to provide your own.

data/lib/action_controller/metal/streaming.rb CHANGED Viewed

@@ -183,7 +183,7 @@ module ActionController #:nodoc:
   # You may also want to configure other parameters like <tt>:tcp_nodelay</tt>.
   # Please check its documentation for more information: http://unicorn.bogomips.org/Unicorn/Configurator.html#method-i-listen
   #
-  # If you are using Unicorn with Nginx, you may need to tweak Nginx.
+  # If you are using Unicorn with NGINX, you may need to tweak NGINX.
   # Streaming should work out of the box on Rainbows.
   #
   # ==== Passenger

data/lib/action_controller/metal/strong_parameters.rb CHANGED Viewed

@@ -1,5 +1,7 @@
 require 'active_support/core_ext/hash/indifferent_access'
 require 'active_support/core_ext/array/wrap'
+require 'active_support/core_ext/string/filters'
+require 'active_support/deprecation'
 require 'active_support/rescuable'
 require 'action_dispatch/http/upload'
 require 'stringio'
@@ -32,14 +34,14 @@ module ActionController
     def initialize(params) # :nodoc:
       @params = params
-      super("found unpermitted parameters: #{params.join(", ")}")
+      super("found unpermitted parameter#{'s' if params.size > 1 }: #{params.join(", ")}")
     end
   end
   # == Action Controller \Parameters
   #
   # Allows to choose which attributes should be whitelisted for mass updating
-  # and thus prevent accidentally exposing that which shouldn’t be exposed.
+  # and thus prevent accidentally exposing that which shouldn't be exposed.
   # Provides two methods for this purpose: #require and #permit. The former is
   # used to mark parameters as required. The latter is used to set the parameter
   # as permitted and limit which attributes should be allowed for mass updating.
@@ -90,7 +92,11 @@ module ActionController
   #   params.permit(:c)
   #   # => ActionController::UnpermittedParameters: found unpermitted keys: a, b
   #
-  # <tt>ActionController::Parameters</tt> is inherited from
+  # Please note that these options *are not thread-safe*. In a multi-threaded
+  # environment they should only be set once at boot-time and never mutated at
+  # runtime.
+  #
+  # <tt>ActionController::Parameters</tt> inherits from
   # <tt>ActiveSupport::HashWithIndifferentAccess</tt>, this means
   # that you can fetch values using either <tt>:key</tt> or <tt>"key"</tt>.
   #
@@ -101,9 +107,25 @@ module ActionController
     cattr_accessor :permit_all_parameters, instance_accessor: false
     cattr_accessor :action_on_unpermitted_parameters, instance_accessor: false
-    # Never raise an UnpermittedParameters exception because of these params
-    # are present. They are added by Rails and it's of no concern.
-    NEVER_UNPERMITTED_PARAMS = %w( controller action )
+    # By default, never raise an UnpermittedParameters exception if these
+    # params are present. The default includes both 'controller' and 'action'
+    # because they are added by Rails and should be of no concern. One way
+    # to change these is to specify `always_permitted_parameters` in your
+    # config. For instance:
+    #
+    #    config.always_permitted_parameters = %w( controller action format )
+    cattr_accessor :always_permitted_parameters
+    self.always_permitted_parameters = %w( controller action )
+    def self.const_missing(const_name)
+      super unless const_name == :NEVER_UNPERMITTED_PARAMS
+      ActiveSupport::Deprecation.warn(<<-MSG.squish)
+        `ActionController::Parameters::NEVER_UNPERMITTED_PARAMS` has been deprecated.
+        Use `ActionController::Parameters.always_permitted_parameters` instead.
+      MSG
+      always_permitted_parameters
+    end
     # Returns a new instance of <tt>ActionController::Parameters</tt>.
     # Also, sets the +permitted+ attribute to the default value of
@@ -126,9 +148,50 @@ module ActionController
       @permitted = self.class.permit_all_parameters
     end
+    # Returns a safe +Hash+ representation of this parameter with all
+    # unpermitted keys removed.
+    #
+    #   params = ActionController::Parameters.new({
+    #     name: 'Senjougahara Hitagi',
+    #     oddity: 'Heavy stone crab'
+    #   })
+    #   params.to_h # => {}
+    #
+    #   safe_params = params.permit(:name)
+    #   safe_params.to_h # => {"name"=>"Senjougahara Hitagi"}
+    def to_h
+      if permitted?
+        to_hash
+      else
+        slice(*self.class.always_permitted_parameters).permit!.to_h
+      end
+    end
+    # Returns an unsafe, unfiltered +Hash+ representation of this parameter.
+    def to_unsafe_h
+      to_hash
+    end
+    alias_method :to_unsafe_hash, :to_unsafe_h
+    # Convert all hashes in values into parameters, then yield each pair like
+    # the same way as <tt>Hash#each_pair</tt>
+    def each_pair(&block)
+      super do |key, value|
+        convert_hashes_to_parameters(key, value)
+      end
+      super
+    end
+    alias_method :each, :each_pair
     # Attribute that keeps track of converted arrays, if any, to avoid double
     # looping in the common use case permit + mass-assignment. Defined in a
     # method to instantiate it only if needed.
+    #
+    # Testing membership still loops, but it's going to be faster than our own
+    # loop that converts values. Also, we are not going to build a new array
+    # object per fetch.
     def converted_arrays
       @converted_arrays ||= Set.new
     end
@@ -157,9 +220,8 @@ module ActionController
     #   Person.new(params) # => #<Person id: nil, name: "Francesco">
     def permit!
       each_pair do |key, value|
-        value = convert_hashes_to_parameters(key, value)
-        Array.wrap(value).each do |_|
-          _.permit! if _.respond_to? :permit!
+        Array.wrap(value).each do |v|
+          v.permit! if v.respond_to? :permit!
         end
       end
@@ -312,11 +374,56 @@ module ActionController
     #   params.slice(:a, :b) # => {"a"=>1, "b"=>2}
     #   params.slice(:d)     # => {}
     def slice(*keys)
-      self.class.new(super).tap do |new_instance|
-        new_instance.permitted = @permitted
+      new_instance_with_inherited_permitted_status(super)
+    end
+    # Removes and returns the key/value pairs matching the given keys.
+    #
+    #   params = ActionController::Parameters.new(a: 1, b: 2, c: 3)
+    #   params.extract!(:a, :b) # => {"a"=>1, "b"=>2}
+    #   params                  # => {"c"=>3}
+    def extract!(*keys)
+      new_instance_with_inherited_permitted_status(super)
+    end
+    # Returns a new <tt>ActionController::Parameters</tt> with the results of
+    # running +block+ once for every value. The keys are unchanged.
+    #
+    #   params = ActionController::Parameters.new(a: 1, b: 2, c: 3)
+    #   params.transform_values { |x| x * 2 }
+    #   # => {"a"=>2, "b"=>4, "c"=>6}
+    def transform_values
+      if block_given?
+        new_instance_with_inherited_permitted_status(super)
+      else
+        super
+      end
+    end
+    # This method is here only to make sure that the returned object has the
+    # correct +permitted+ status. It should not matter since the parent of
+    # this object is +HashWithIndifferentAccess+
+    def transform_keys # :nodoc:
+      if block_given?
+        new_instance_with_inherited_permitted_status(super)
+      else
+        super
       end
     end
+    # Deletes and returns a key-value pair from +Parameters+ whose key is equal
+    # to key. If the key is not found, returns the default value. If the
+    # optional code block is given and the key is not found, pass in the key
+    # and return the result of block.
+    def delete(key, &block)
+      convert_hashes_to_parameters(key, super, false)
+    end
+    # Equivalent to Hash#keep_if, but returns nil if no changes were made.
+    def select!(&block)
+      convert_value_to_parameters(super)
+    end
     # Returns an exact copy of the <tt>ActionController::Parameters</tt>
     # instance. +permitted+ state is kept on the duped object.
     #
@@ -337,6 +444,12 @@ module ActionController
       end
     private
+      def new_instance_with_inherited_permitted_status(hash)
+        self.class.new(hash).tap do |new_instance|
+          new_instance.permitted = @permitted
+        end
+      end
       def convert_hashes_to_parameters(key, value, assign_if_converted=true)
         converted = convert_value_to_parameters(value)
         self[key] = converted if assign_if_converted && !converted.equal?(value)
@@ -385,7 +498,7 @@ module ActionController
       end
       def unpermitted_keys(params)
-        self.keys - params.keys - NEVER_UNPERMITTED_PARAMS
+        self.keys - params.keys - self.always_permitted_parameters
       end
       #