Allow developers to enable raising of exception when unexpected params are provided.

2 files changed, 31 insertions, 6 deletions

diff --git a/actionpack/lib/action_controller/metal/strong_parameters.rb b/actionpack/lib/action_controller/metal/strong_parameters.rb
index da380dfbd8..b566dad9eb 100644
--- a/actionpack/lib/action_controller/metal/strong_parameters.rb
+++ b/actionpack/lib/action_controller/metal/strong_parameters.rb
@@ -20,6 +20,20 @@ module ActionController
     end
   end
 
+  # Raised when a supplied parameter is not expected.
+  #
+  #   params = ActionController::Parameters.new(a: "123", b: "456")
+  #   params.permit(:c)
+  #   # => ActionController::UnexpectedParameter: found unexpected keys: a, b
+  class UnexpectedParameters < IndexError
+    attr_reader :params
+
+    def initialize(params)
+      @params = params
+      super("found unexpected keys: #{params.join(", ")}")
+    end
+  end
+
   # == Action Controller \Parameters
   #
   # Allows to choose which attributes should be whitelisted for mass updating
@@ -66,6 +80,7 @@ module ActionController
   #   params["key"] # => "value"
   class Parameters < ActiveSupport::HashWithIndifferentAccess
     cattr_accessor :permit_all_parameters, instance_accessor: false
+    cattr_accessor :raise_on_unexpected, instance_accessor: false
 
     # Returns a new instance of <tt>ActionController::Parameters</tt>.
     # Also, sets the +permitted+ attribute to the default value of
@@ -223,6 +238,13 @@ module ActionController
         end
       end
 
+      if Parameters.raise_on_unexpected
+        unexpected_keys = self.keys - params.keys
+        if unexpected_keys.any?
+          raise ActionController::UnexpectedParameters.new(unexpected_keys)
+        end
+      end
+
       params.permit!
     end
 
diff --git a/actionpack/lib/action_controller/railtie.rb b/actionpack/lib/action_controller/railtie.rb
index 3e44155f73..4007000608 100644
--- a/actionpack/lib/action_controller/railtie.rb
+++ b/actionpack/lib/action_controller/railtie.rb
@@ -21,21 +21,24 @@ module ActionController
 
     initializer "action_controller.parameters_config" do |app|
       ActionController::Parameters.permit_all_parameters = app.config.action_controller.delete(:permit_all_parameters) { false }
+      ActionController::Parameters.raise_on_unexpected = app.config.action_controller.raise_on_unexpected_params
     end
 
     initializer "action_controller.set_configs" do |app|
       paths   = app.config.paths
       options = app.config.action_controller
 
-      options.logger               ||= Rails.logger
-      options.cache_store          ||= Rails.cache
+      options.logger                      ||= Rails.logger
+      options.cache_store                 ||= Rails.cache
 
-      options.javascripts_dir      ||= paths["public/javascripts"].first
-      options.stylesheets_dir      ||= paths["public/stylesheets"].first
+      options.javascripts_dir             ||= paths["public/javascripts"].first
+      options.stylesheets_dir             ||= paths["public/stylesheets"].first
 
       # Ensure readers methods get compiled
-      options.asset_host           ||= app.config.asset_host
-      options.relative_url_root    ||= app.config.relative_url_root
+      options.asset_host                  ||= app.config.asset_host
+      options.relative_url_root           ||= app.config.relative_url_root
+
+      options.raise_on_unexpected_params  ||= (Rails.env.test? || Rails.env.development?)
 
       ActiveSupport.on_load(:action_controller) do
         include app.routes.mounted_helpers