Merge pull request #21502 from bernerdschaefer/bs-polymorphic-url_for-dups-arguments

`url_for` does not modify polymorphic options

3 files changed, 26 insertions, 1 deletions

diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index f2229d61fb..73a833a23b 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -1,3 +1,7 @@
+*   `url_for` does not modify its arguments when generating polymorphic URLs.
+
+    *Bernerd Schaefer*
+
 *   Make it easier to opt in to `config.force_ssl` and `config.ssl_options` by
     making them less dangerous to try and easier to disable.
 
diff --git a/actionpack/lib/action_dispatch/routing/url_for.rb b/actionpack/lib/action_dispatch/routing/url_for.rb
index 967bbd62f8..883cd9c2c3 100644
--- a/actionpack/lib/action_dispatch/routing/url_for.rb
+++ b/actionpack/lib/action_dispatch/routing/url_for.rb
@@ -180,7 +180,8 @@ module ActionDispatch
         when Symbol
           HelperMethodBuilder.url.handle_string_call self, options
         when Array
-          polymorphic_url(options, options.extract_options!)
+          components = options.dup
+          polymorphic_url(components, components.extract_options!)
         when Class
           HelperMethodBuilder.url.handle_class_call self, options
         else
diff --git a/actionpack/test/controller/url_for_test.rb b/actionpack/test/controller/url_for_test.rb
index 31677f202d..78e883f134 100644
--- a/actionpack/test/controller/url_for_test.rb
+++ b/actionpack/test/controller/url_for_test.rb
@@ -451,6 +451,26 @@ module AbstractController
         end
       end
 
+      def test_url_for_with_array_is_unmodified
+        with_routing do |set|
+          set.draw do
+            namespace :admin do
+              resources :posts
+            end
+          end
+
+          kls = Class.new { include set.url_helpers }
+          kls.default_url_options[:host] = 'www.basecamphq.com'
+
+          original_components = [:new, :admin, :post, { param: 'value' }]
+          components = original_components.dup
+
+          kls.new.url_for(components)
+
+          assert_equal(original_components, components)
+        end
+      end
+
       private
         def extract_params(url)
           url.split('?', 2).last.split('&').sort