Make Parameters support legacy YAML encodings.

By changing ActionController::Parameter's superclass, Rails 5 also changed
the YAML serialization format.

Since YAML doesn't know how to handle parameters it would fallback to its
routine for the superclass, which in Rails 4.2 was Hash while just Object
in Rails 5. As evident in the tags YAML would spit out:

4.2: !ruby/hash-with-ivars:ActionController::Parameters
5.0: !ruby/object:ActionController::Parameters

Thus when loading parameters YAML from 4.2 in Rails 5, it would parse a
hash dump as it would an Object class.

To fix this we have to provide our own `init_with` to be aware of the past
format as well as the new one. Then we add a `load_tags` mapping, such that
when the YAML parser sees `!ruby/hash-with-ivars:ActionController::Parameters`,
it knows to call our `init_with` function and not try to instantiate it as
a normal hash subclass.

1 files changed, 19 insertions, 0 deletions

diff --git a/actionpack/lib/action_controller/metal/strong_parameters.rb b/actionpack/lib/action_controller/metal/strong_parameters.rb
index 26794c67b7..98624ba103 100644
--- a/actionpack/lib/action_controller/metal/strong_parameters.rb
+++ b/actionpack/lib/action_controller/metal/strong_parameters.rb
@@ -7,6 +7,12 @@ require 'action_dispatch/http/upload'
 require 'rack/test'
 require 'stringio'
 require 'set'
+require 'yaml'
+
+# Wire up YAML format compatibility with Rails 4.2. Makes the YAML parser call
+# `init_with` when it encounters `!ruby/hash-with-ivars:ActionController::Parameters`,
+# instead of trying to parse it as a regular hash subclass.
+YAML.load_tags['!ruby/hash-with-ivars:ActionController::Parameters'] = 'ActionController::Parameters'
 
 module ActionController
   # Raised when a required parameter is missing.
@@ -591,6 +597,19 @@ module ActionController
       "<#{self.class} #{@parameters} permitted: #{@permitted}>"
     end
 
+    def init_with(coder) # :nodoc:
+      if coder.map['elements']
+        # YAML's Hash subclass format from Rails 4.2, where keys and values
+        # were stored under an elements hash and `permitted` within an ivars hash.
+        @parameters = coder.map['elements'].with_indifferent_access
+        @permitted  = coder.map['ivars'][:@permitted]
+      else
+        # YAML's Object format. Only needed because of the format
+        # backwardscompability above, otherwise equivalent to YAML's initialization.
+        @parameters, @permitted = coder.map['parameters'], coder.map['permitted']
+      end
+    end
+
     def method_missing(method_sym, *args, &block)
       if @parameters.respond_to?(method_sym)
         message = <<-DEPRECATE.squish