2 files changed, 44 insertions, 5 deletions
diff --git a/actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb b/actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb
index 22e603b881..9ce04b9aeb 100644
--- a/actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb
+++ b/actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb
@@ -10,23 +10,45 @@ class LogOnUnpermittedParamsTest < ActiveSupport::TestCase
     ActionController::Parameters.action_on_unpermitted_parameters = false
   end
 
-  test "logs on unexpected params" do
+  test "logs on unexpected param" do
     params = ActionController::Parameters.new({
       book: { pages: 65 },
       fishing: "Turnips"
     })
 
-    assert_logged("Unpermitted parameters: fishing") do
+    assert_logged("Unpermitted parameter: fishing") do
       params.permit(book: [:pages])
     end
   end
 
-  test "logs on unexpected nested params" do
+  test "logs on unexpected params" do
+    params = ActionController::Parameters.new({
+      book: { pages: 65 },
+      fishing: "Turnips",
+      car: "Mersedes"
+    })
+
+    assert_logged("Unpermitted parameters: fishing, car") do
+      params.permit(book: [:pages])
+    end
+  end
+
+  test "logs on unexpected nested param" do
     params = ActionController::Parameters.new({
       book: { pages: 65, title: "Green Cats and where to find then." }
     })
 
-    assert_logged("Unpermitted parameters: title") do
+    assert_logged("Unpermitted parameter: title") do
+      params.permit(book: [:pages])
+    end
+  end
+
+  test "logs on unexpected nested params" do
+    params = ActionController::Parameters.new({
+      book: { pages: 65, title: "Green Cats and where to find then.", author: "G. A. Dog" }
+    })
+
+    assert_logged("Unpermitted parameters: title, author") do
       params.permit(book: [:pages])
     end
   end
diff --git a/actionpack/test/controller/parameters/parameters_permit_test.rb b/actionpack/test/controller/parameters/parameters_permit_test.rb
index 33a91d72d9..aa894ffa17 100644
--- a/actionpack/test/controller/parameters/parameters_permit_test.rb
+++ b/actionpack/test/controller/parameters/parameters_permit_test.rb
@@ -167,9 +167,26 @@ class ParametersPermitTest < ActiveSupport::TestCase
     end
   end
 
+  # Strong params has an optimization to avoid looping every time you read
+  # a key whose value is an array and building a new object. We check that
+  # optimization here.
   test 'arrays are converted at most once' do
     params = ActionController::Parameters.new(foo: [{}])
-    assert params[:foo].equal?(params[:foo])
+    assert_same params[:foo], params[:foo]
+  end
+
+  # Strong params has an internal cache to avoid duplicated loops in the most
+  # common usage pattern. See the docs of the method `converted_arrays`.
+  #
+  # This test checks that if we push a hash to an array (in-place modification)
+  # the cache does not get fooled, the hash is still wrapped as strong params,
+  # and not permitted.
+  test 'mutated arrays are detected' do
+    params = ActionController::Parameters.new(users: [{id: 1}])
+
+    permitted = params.permit(users: [:id])
+    permitted[:users] << {injected: 1}
+    assert_not permitted[:users].last.permitted?
   end
 
   test "fetch doesnt raise ParameterMissing exception if there is a default" do