strong_parameters 0.1.6 → 0.2.0

data/README.rdoc

@@ -15,9 +15,9 @@ In addition, parameters can be marked as required and flow through a predefined
       # it'll raise a ActionController::MissingParameter exception, which will get caught by
       # ActionController::Base and turned into that 400 Bad Request reply.
       def update
-        redirect_to current_account.people.find(params[:id]).tap { |person|
-          person.update_attributes!(person_params)
-        }
+        person = current_account.people.find(params[:id])
+        person.update_attributes!(person_params)
+        redirect_to person
       end
 
       private
@@ -29,12 +29,50 @@ In addition, parameters can be marked as required and flow through a predefined
         end
     end
 
+== Permitted Scalar Values
+
+Given
+
+    params.permit(:id)
+
+the key +:id+ will pass the whitelisting if it appears in +params+ and it has a permitted scalar value associated. Otherwise the key is going to be filtered out, so arrays, hashes, or any other objects cannot be injected.
+
+The permitted scalar types are +String+, +Symbol+, +NilClass+, +Numeric+, +TrueClass+, +FalseClass+, +Date+, +Time+, +DateTime+, +StringIO+, +IO+, and +ActionDispatch::Http::UploadedFile+.
+
+To declare that the value in +params+ must be an array of permitted scalar values map the key to an empty array:
+
+    params.permit(:id => [])
+
+== Nested Parameters
+
 You can also use permit on nested parameters, like:
 
-    params.permit(:name, friends: [ :name, { family: [ :name ] }])
+    params.permit(:name, {:emails => []}, :friends => [ :name, { :family => [ :name ], :hobbies => [] }])
+
+This declaration whitelists the +name+, +emails+ and +friends+ attributes. It is expected that +emails+ will be an array of permitted scalar values and that +friends+ will be an array of resources with specific attributes : they should have a +name+ attribute (any permitted scalar values allowed), a +hobbies+ attribute as an array of permitted scalar values, and a +family+ attribute which is restricted to having a +name+ (any permitted scalar values allowed, too).
 
 Thanks to Nick Kallen for the permit idea!
 
+== Handling of Unpermitted Keys
+
+By default parameter keys that are not explicitly permitted will be logged in the development and test environment. In other environments these parameters will simply be filtered out and ignored.
+
+Additionally, this behaviour can be changed by changing the +config.action_controller.action_on_unpermitted_parameters+ property in your environment files. If set to +:log+ the unpermitted attributes will be logged, if set to +:raise+ an exception will be raised.
+
+== Use Outside of Controllers
+
+While Strong Parameters will enforce permitted and required values in your application controllers, keep in mind
+that you will need to sanitize untrusted data used for mass assignment when in use outside of controllers.
+
+For example, if you retrieve JSON data from a third party API call and pass the unchecked parsed result on to
++Model.create+, undesired mass assignments could take place.  You can alleviate this risk by slicing the hash data,
+or wrapping the data in a new instance of +ActionController::Parameters+ and declaring permissions the same as
+you would in a controller.  For example:
+
+    raw_parameters = { :email => "john@example.com", :name => "John", :admin => true }
+    parameters = ActionController::Parameters.new(raw_parameters)
+    user = User.create(parameters.permit(:name, :email))
+
 == Installation
 
 In Gemfile:
@@ -48,6 +86,10 @@ every model you want protected.
       include ActiveModel::ForbiddenAttributesProtection
     end
 
+Alternatively, you can protect all Active Record resources by default by creating an initializer and pasting the line:
+
+    ActiveRecord::Base.send(:include, ActiveModel::ForbiddenAttributesProtection)
+
 If you want to now disable the default whitelisting that occurs in later versions of Rails, change the +config.active_record.whitelist_attributes+ property in your +config/application.rb+:
 
     config.active_record.whitelist_attributes = false
@@ -57,3 +99,4 @@ This will allow you to remove / not have to use +attr_accessible+ and do mass as
 == Compatibility
 
 This plugin is only fully compatible with Rails versions 3.0, 3.1 and 3.2 but not 4.0+, as it is part of Rails Core in 4.0.
+An unofficial Rails 2 version is {strong_parameters_rails2}[https://github.com/grosser/strong_parameters/tree/rails2].

data/lib/action_controller/parameters.rb

@@ -1,6 +1,11 @@
+require 'date'
+require 'bigdecimal'
+require 'stringio'
+
 require 'active_support/concern'
 require 'active_support/core_ext/hash/indifferent_access'
 require 'action_controller'
+require 'action_dispatch/http/upload'
 
 module ActionController
   class ParameterMissing < IndexError
@@ -12,9 +17,24 @@ module ActionController
     end
   end
 
+  class UnpermittedParameters < IndexError
+    attr_reader :params
+
+    def initialize(params)
+      @params = params
+      super("found unpermitted parameters: #{params.join(", ")}")
+    end
+  end
+
   class Parameters < ActiveSupport::HashWithIndifferentAccess
     attr_accessor :permitted
     alias :permitted? :permitted
+    
+    cattr_accessor :action_on_unpermitted_parameters, :instance_accessor => false
+
+    # Never raise an UnpermittedParameters exception because of these params
+    # are present. They are added by Rails and it's of no concern.
+    NEVER_UNPERMITTED_PARAMS = %w( controller action )
 
     def initialize(attributes = nil)
       super(attributes)
@@ -42,29 +62,15 @@ module ActionController
 
       filters.each do |filter|
         case filter
-        when Symbol, String then
-          params[filter] = self[filter] if has_key?(filter)
-          keys.grep(/\A#{Regexp.escape(filter.to_s)}\(\d+[if]?\)\z/).each { |key| params[key] = self[key] }
+        when Symbol, String
+          permitted_scalar_filter(params, filter)
         when Hash then
-          filter = filter.with_indifferent_access
-
-          self.slice(*filter.keys).each do |key, value|
-            return unless value
-
-            key = key.to_sym
-
-            params[key] = each_element(value) do |value|
-              # filters are a Hash, so we expect value to be a Hash too
-              next if filter.is_a?(Hash) && !value.is_a?(Hash)
-
-              value = self.class.new(value) if !value.respond_to?(:permit)
-
-              value.permit(*Array.wrap(filter[key]))
-            end
-          end
+          hash_filter(params, filter)
         end
       end
 
+      unpermitted_parameters!(params) if self.class.action_on_unpermitted_parameters
+
       params.permit!
     end
 
@@ -103,6 +109,7 @@ module ActionController
       end
 
     private
+
       def convert_hashes_to_parameters(key, value)
         if value.is_a?(Parameters) || !value.is_a?(Hash)
           value
@@ -112,18 +119,113 @@ module ActionController
         end
       end
 
-      def each_element(object)
-        if object.is_a?(Array)
-          object.map { |el| yield el }.compact
-        # fields_for on an array of records uses numeric hash keys
-        elsif object.is_a?(Hash) && object.keys.all? { |k| k =~ /\A-?\d+\z/ }
-          hash = object.class.new
-          object.each { |k,v| hash[k] = yield v }
+      #
+      # --- Filtering ----------------------------------------------------------
+      #
+
+      # This is a white list of permitted scalar types that includes the ones
+      # supported in XML and JSON requests.
+      #
+      # This list is in particular used to filter ordinary requests, String goes
+      # as first element to quickly short-circuit the common case.
+      #
+      # If you modify this collection please update the README.
+      PERMITTED_SCALAR_TYPES = [
+        String,
+        Symbol,
+        NilClass,
+        Numeric,
+        TrueClass,
+        FalseClass,
+        Date,
+        Time,
+        # DateTimes are Dates, we document the type but avoid the redundant check.
+        StringIO,
+        IO,
+        ActionDispatch::Http::UploadedFile,
+      ]
+
+      def permitted_scalar?(value)
+        PERMITTED_SCALAR_TYPES.any? {|type| value.is_a?(type)}
+      end
+
+      def array_of_permitted_scalars?(value)
+        if value.is_a?(Array)
+          value.all? {|element| permitted_scalar?(element)}
+        end
+      end
+
+      def permitted_scalar_filter(params, key)
+        if has_key?(key) && permitted_scalar?(self[key])
+          params[key] = self[key]
+        end
+
+        keys.grep(/\A#{Regexp.escape(key.to_s)}\(\d+[if]?\)\z/).each do |key|
+          if permitted_scalar?(self[key])
+            params[key] = self[key]
+          end
+        end
+      end
+
+      def array_of_permitted_scalars_filter(params, key)
+        if has_key?(key) && array_of_permitted_scalars?(self[key])
+          params[key] = self[key]
+        end
+      end
+
+      def hash_filter(params, filter)
+        filter = filter.with_indifferent_access
+
+        # Slicing filters out non-declared keys.
+        slice(*filter.keys).each do |key, value|
+          return unless value
+
+          if filter[key] == []
+            # Declaration {:comment_ids => []}.
+            array_of_permitted_scalars_filter(params, key)
+          else
+            # Declaration {:user => :name} or {:user => [:name, :age, {:adress => ...}]}.
+            params[key] = each_element(value) do |element|
+              if element.is_a?(Hash)
+                element = self.class.new(element) unless element.respond_to?(:permit)
+                element.permit(*Array.wrap(filter[key]))
+              end
+            end
+          end
+        end
+      end
+
+      def each_element(value)
+        if value.is_a?(Array)
+          value.map { |el| yield el }.compact
+          # fields_for on an array of records uses numeric hash keys.
+        elsif value.is_a?(Hash) && value.keys.all? { |k| k =~ /\A-?\d+\z/ }
+          hash = value.class.new
+          value.each { |k,v| hash[k] = yield v }
           hash
         else
-          yield object
+          yield value
         end
       end
+
+      def unpermitted_parameters!(params)  
+        return unless self.class.action_on_unpermitted_parameters
+        
+        unpermitted_keys = unpermitted_keys(params)
+
+        if unpermitted_keys.any?  
+          case self.class.action_on_unpermitted_parameters  
+          when :log  
+            ActionController::Base.logger.debug "Unpermitted parameters: #{unpermitted_keys.join(", ")}"  
+          when :raise  
+            raise ActionController::UnpermittedParameters.new(unpermitted_keys)  
+          end  
+        end  
+      end  
+  
+      def unpermitted_keys(params)  
+        self.keys - params.keys - NEVER_UNPERMITTED_PARAMS
+      end
   end
 
   module StrongParameters

data/lib/active_model/forbidden_attributes_protection.rb

@@ -13,5 +13,3 @@ module ActiveModel
     end
   end
 end
-
-ActiveModel.autoload :ForbiddenAttributesProtection

data/lib/strong_parameters/railtie.rb

@@ -7,5 +7,11 @@ module StrongParameters
     else
       config.generators.scaffold_controller = :strong_parameters_controller
     end
+
+    initializer "strong_parameters.config", :before => "action_controller.set_configs" do |app|
+      ActionController::Parameters.action_on_unpermitted_parameters = app.config.action_controller.delete(:action_on_unpermitted_parameters) do
+        (Rails.env.test? || Rails.env.development?) ? :log : false
+      end
+    end
   end
 end

data/lib/strong_parameters/version.rb

@@ -1,3 +1,3 @@
 module StrongParameters
-  VERSION = "0.1.6"
+  VERSION = "0.2.0"
 end

data/test/controller_generator_test.rb

@@ -14,19 +14,19 @@ class StrongParametersControllerGeneratorTest < Rails::Generators::TestCase
     assert_file "app/controllers/users_controller.rb" do |content|
 
       assert_instance_method :create, content do |m|
-        assert_match(/@user = User\.new\(user_params\)/, m)
-        assert_match(/@user\.save/, m)
-        assert_match(/@user\.errors/, m)
+        assert_match '@user = User.new(user_params)', m
+        assert_match '@user.save', m
+        assert_match '@user.errors', m
       end
 
       assert_instance_method :update, content do |m|
-        assert_match(/@user = User\.find\(params\[:id\]\)/, m)
-        assert_match(/@user\.update_attributes\(user_params\)/, m)
-        assert_match(/@user\.errors/, m)
+        assert_match '@user = User.find(params[:id])', m
+        assert_match '@user.update_attributes(user_params)', m
+        assert_match '@user.errors', m
       end
 
-      assert_match(/def user_params/, content)
-      assert_match(/params\.require\(:user\)\.permit\(:age, :name\)/, content)
+      assert_match 'def user_params', content
+      assert_match 'params.require(:user).permit(:age, :name)', content
     end
   end
 end

data/test/dummy/log/test.log

@@ -0,0 +1,88 @@
+   (0.2ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.2ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.2ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.2ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.2ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.2ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.2ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.0ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.3ms)  begin transaction
+   (0.0ms)  rollback transaction
+   (0.3ms)  begin transaction
+   (0.0ms)  rollback transaction

data/test/log_on_unpermitted_params_test.rb

@@ -0,0 +1,50 @@
+require 'test_helper'
+require 'action_controller/parameters'
+
+class LogOnUnpermittedParamsTest < ActiveSupport::TestCase
+  def setup
+    ActionController::Parameters.action_on_unpermitted_parameters = :log
+  end
+
+  def teardown
+    ActionController::Parameters.action_on_unpermitted_parameters = false
+  end
+
+  test "logs on unexpected params" do
+    params = ActionController::Parameters.new({
+      :book => { :pages => 65 },
+      :fishing => "Turnips"
+    })
+
+    assert_logged("Unpermitted parameters: fishing") do
+      params.permit(:book => [:pages])
+    end
+  end
+
+  test "logs on unexpected nested params" do
+    params = ActionController::Parameters.new({
+      :book => { :pages => 65, :title => "Green Cats and where to find then." }
+    })
+
+    assert_logged("Unpermitted parameters: title") do
+      params.permit(:book => [:pages])
+    end
+  end
+
+  private
+
+  def assert_logged(message)
+    old_logger = ActionController::Base.logger
+    log = StringIO.new
+    ActionController::Base.logger = Logger.new(log)
+
+    begin
+      yield
+
+      log.rewind
+      assert_match message, log.read
+    ensure
+      ActionController::Base.logger = old_logger
+    end
+  end
+end

data/test/{nested_parameters_test.rb → parameters_permit_test.rb}

@@ -1,7 +1,136 @@
 require 'test_helper'
 require 'action_controller/parameters'
+require 'action_dispatch/http/upload'
 
 class NestedParametersTest < ActiveSupport::TestCase
+  def assert_filtered_out(params, key)
+    assert !params.has_key?(key), "key #{key.inspect} has not been filtered out"
+  end
+
+  #
+  # --- Basic interface --------------------------------------------------------
+  #
+
+  # --- nothing ----------------------------------------------------------------
+
+  test 'if nothing is permitted, the hash becomes empty' do
+    params = ActionController::Parameters.new(:id => '1234')
+    permitted = params.permit
+    permitted.permitted?
+    permitted.empty?
+  end
+
+  # --- key --------------------------------------------------------------------
+
+  test 'key: permitted scalar values' do
+    values  = ['a', :a, nil]
+    values += [0, 1.0, 2**128, BigDecimal.new('1')]
+    values += [true, false]
+    values += [Date.today, Time.now, DateTime.now]
+    values += [StringIO.new, STDOUT, ActionDispatch::Http::UploadedFile.new(:tempfile => __FILE__)]
+
+    values.each do |value|
+      params = ActionController::Parameters.new(:id => value)
+      permitted = params.permit(:id)
+      assert_equal value, permitted[:id]
+
+      %w(i f).each do |suffix|
+        params = ActionController::Parameters.new("foo(000#{suffix})" => value)
+        permitted = params.permit(:foo)
+        assert_equal value, permitted["foo(000#{suffix})"]
+      end
+    end
+  end
+
+  test 'key: unknown keys are filtered out' do
+    params = ActionController::Parameters.new(:id => '1234', :injected => 'injected')
+    permitted = params.permit(:id)
+    assert_equal '1234', permitted[:id]
+    assert_filtered_out permitted, :injected
+  end
+
+  test 'key: arrays are filtered out' do
+    [[], [1], ['1']].each do |array|
+      params = ActionController::Parameters.new(:id => array)
+      permitted = params.permit(:id)
+      assert_filtered_out permitted, :id
+
+      %w(i f).each do |suffix|
+        params = ActionController::Parameters.new("foo(000#{suffix})" => array)
+        permitted = params.permit(:foo)
+        assert_filtered_out permitted, "foo(000#{suffix})"
+      end
+    end
+  end
+
+  test 'key: hashes are filtered out' do
+    [{}, {:foo => 1}, {:foo => 'bar'}].each do |hash|
+      params = ActionController::Parameters.new(:id => hash)
+      permitted = params.permit(:id)
+      assert_filtered_out permitted, :id
+
+      %w(i f).each do |suffix|
+        params = ActionController::Parameters.new("foo(000#{suffix})" => hash)
+        permitted = params.permit(:foo)
+        assert_filtered_out permitted, "foo(000#{suffix})"
+      end
+    end
+  end
+
+  test 'key: non-permitted scalar values are filtered out' do
+    params = ActionController::Parameters.new(:id => Object.new)
+    permitted = params.permit(:id)
+    assert_filtered_out permitted, :id
+
+    %w(i f).each do |suffix|
+      params = ActionController::Parameters.new("foo(000#{suffix})" => Object.new)
+      permitted = params.permit(:foo)
+      assert_filtered_out permitted, "foo(000#{suffix})"
+    end
+  end
+
+  test 'key: it is not assigned if not present in params' do
+    params = ActionController::Parameters.new(:name => 'Joe')
+    permitted = params.permit(:id)
+    assert !permitted.has_key?(:id)
+  end
+
+  # --- key to empty array -----------------------------------------------------
+
+  test 'key to empty array: empty arrays pass' do
+    params = ActionController::Parameters.new(:id => [])
+    permitted = params.permit(:id => [])
+    assert_equal [], permitted[:id]
+  end
+
+  test 'key to empty array: arrays of permitted scalars pass' do
+    [['foo'], [1], ['foo', 'bar'], [1, 2, 3]].each do |array|
+      params = ActionController::Parameters.new(:id => array)
+      permitted = params.permit(:id => [])
+      assert_equal array, permitted[:id]
+    end
+  end
+
+  test 'key to empty array: permitted scalar values do not pass' do
+    ['foo', 1].each do |permitted_scalar|
+      params = ActionController::Parameters.new(:id => permitted_scalar)
+      permitted = params.permit(:id => [])
+      assert_filtered_out permitted, :id
+    end
+  end
+
+  test 'key to empty array: arrays of non-permitted scalar do not pass' do
+    [[Object.new], [[]], [[1]], [{}], [{:id => '1'}]].each do |non_permitted_scalar|
+      params = ActionController::Parameters.new(:id => non_permitted_scalar)
+      permitted = params.permit(:id => [])
+      assert_filtered_out permitted, :id
+    end
+  end
+
+  #
+  # --- Nesting ----------------------------------------------------------------
+  #
+
   test "permitted nested parameters" do
     params = ActionController::Parameters.new({
       :book => {
@@ -11,6 +140,8 @@ class NestedParametersTest < ActiveSupport::TestCase
           :born => "1564-04-26"
         }, {
           :name => "Christopher Marlowe"
+        }, {
+          :name => %w(malicious injected names)
         }],
         :details => {
           :pages => 200,
@@ -27,9 +158,12 @@ class NestedParametersTest < ActiveSupport::TestCase
     assert_equal "William Shakespeare", permitted[:book][:authors][0][:name]
     assert_equal "Christopher Marlowe", permitted[:book][:authors][1][:name]
     assert_equal 200, permitted[:book][:details][:pages]
-    assert_nil permitted[:book][:details][:genre]
-    assert_nil permitted[:book][:authors][1][:born]
-    assert_nil permitted[:magazine]
+
+    assert_filtered_out permitted[:book][:authors][2], :name
+
+    assert_filtered_out permitted, :magazine
+    assert_filtered_out permitted[:book][:details], :genre
+    assert_filtered_out permitted[:book][:authors][0], :born
   end
 
   test "permitted nested parameters with a string or a symbol as a key" do
@@ -64,7 +198,7 @@ class NestedParametersTest < ActiveSupport::TestCase
       }
     })
 
-    permitted = params.permit :book => :genres
+    permitted = params.permit :book => {:genres => []}
     assert_equal ["Tragedy"], permitted[:book][:genres]
   end
 
@@ -123,7 +257,8 @@ class NestedParametersTest < ActiveSupport::TestCase
       :book => {
         :authors_attributes => {
           :'0' => { :name => 'William Shakespeare', :age_of_death => '52' },
-          :'1' => { :name => 'Unattributed Assistant' }
+          :'1' => { :name => 'Unattributed Assistant' },
+          :'2' => { :name => %w(injected names)}
         }
       }
     })
@@ -131,9 +266,11 @@ class NestedParametersTest < ActiveSupport::TestCase
 
     assert_not_nil permitted[:book][:authors_attributes]['0']
     assert_not_nil permitted[:book][:authors_attributes]['1']
-    assert_nil permitted[:book][:authors_attributes]['0'][:age_of_death]
+    assert permitted[:book][:authors_attributes]['2'].empty?
     assert_equal 'William Shakespeare', permitted[:book][:authors_attributes]['0'][:name]
     assert_equal 'Unattributed Assistant', permitted[:book][:authors_attributes]['1'][:name]
+
+    assert_filtered_out permitted[:book][:authors_attributes]['0'], :age_of_death
   end
 
   test "fields_for_style_nested_params with negative numbers" do
@@ -149,8 +286,9 @@ class NestedParametersTest < ActiveSupport::TestCase
 
     assert_not_nil permitted[:book][:authors_attributes]['-1']
     assert_not_nil permitted[:book][:authors_attributes]['-2']
-    assert_nil permitted[:book][:authors_attributes]['-1'][:age_of_death]
     assert_equal 'William Shakespeare', permitted[:book][:authors_attributes]['-1'][:name]
     assert_equal 'Unattributed Assistant', permitted[:book][:authors_attributes]['-2'][:name]
+
+    assert_filtered_out permitted[:book][:authors_attributes]['-1'], :age_of_death
   end
 end

data/test/raise_on_unpermitted_params_test.rb

@@ -0,0 +1,33 @@
+require 'test_helper'
+require 'action_controller/parameters'
+
+class RaiseOnUnpermittedParamsTest < ActiveSupport::TestCase
+  def setup
+    ActionController::Parameters.action_on_unpermitted_parameters = :raise
+  end
+
+  def teardown
+    ActionController::Parameters.action_on_unpermitted_parameters = false
+  end
+
+  test "raises on unexpected params" do
+    params = ActionController::Parameters.new({
+      :book => { :pages => 65 },
+      :fishing => "Turnips"
+    })
+
+    assert_raises(ActionController::UnpermittedParameters) do
+      params.permit(:book => [:pages])
+    end
+  end
+
+  test "raises on unexpected nested params" do
+    params = ActionController::Parameters.new({
+      :book => { :pages => 65, :title => "Green Cats and where to find then." }
+    })
+
+    assert_raises(ActionController::UnpermittedParameters) do
+      params.permit(:book => [:pages])
+    end
+  end
+end

data/test/test_helper.rb

@@ -2,6 +2,13 @@
 ENV["RAILS_ENV"] = "test"
 
 require 'test/unit'
+require 'rails'
+
+class FakeApplication < Rails::Application; end
+
+Rails.application = FakeApplication
+Rails.configuration.action_controller = ActiveSupport::OrderedOptions.new
+
 require 'strong_parameters'
 require 'mocha'
 
@@ -23,6 +30,7 @@ module ActionController
   end
 end
 
+ActionController::Parameters.action_on_unpermitted_parameters = false
 
 # Load support files
 Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each { |f| require f }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: strong_parameters
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.2.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-15 00:00:00.000000000 Z
+date: 2013-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -113,16 +113,20 @@ files:
 - test/action_controller_tainted_params_test.rb
 - test/active_model_mass_assignment_taint_protection_test.rb
 - test/controller_generator_test.rb
+- test/dummy/db/test.sqlite3
+- test/dummy/log/test.log
 - test/gemfiles/Gemfile.rails-3.0.x
 - test/gemfiles/Gemfile.rails-3.0.x.lock
 - test/gemfiles/Gemfile.rails-3.1.x
 - test/gemfiles/Gemfile.rails-3.2.x
+- test/log_on_unpermitted_params_test.rb
 - test/multi_parameter_attributes_test.rb
-- test/nested_parameters_test.rb
+- test/parameters_permit_test.rb
 - test/parameters_require_test.rb
 - test/parameters_taint_test.rb
+- test/raise_on_unpermitted_params_test.rb
 - test/test_helper.rb
-homepage: 
+homepage: https://github.com/rails/strong_parameters
 licenses: []
 post_install_message: 
 rdoc_options: []
@@ -151,12 +155,16 @@ test_files:
 - test/action_controller_tainted_params_test.rb
 - test/active_model_mass_assignment_taint_protection_test.rb
 - test/controller_generator_test.rb
+- test/dummy/db/test.sqlite3
+- test/dummy/log/test.log
 - test/gemfiles/Gemfile.rails-3.0.x
 - test/gemfiles/Gemfile.rails-3.0.x.lock
 - test/gemfiles/Gemfile.rails-3.1.x
 - test/gemfiles/Gemfile.rails-3.2.x
+- test/log_on_unpermitted_params_test.rb
 - test/multi_parameter_attributes_test.rb
-- test/nested_parameters_test.rb
+- test/parameters_permit_test.rb
 - test/parameters_require_test.rb
 - test/parameters_taint_test.rb
+- test/raise_on_unpermitted_params_test.rb
 - test/test_helper.rb