2 files changed, 24 insertions, 4 deletions
diff --git a/actionpack/lib/action_controller/metal/strong_parameters.rb b/actionpack/lib/action_controller/metal/strong_parameters.rb
index 98624ba103..d2db982a6e 100644
--- a/actionpack/lib/action_controller/metal/strong_parameters.rb
+++ b/actionpack/lib/action_controller/metal/strong_parameters.rb
@@ -12,7 +12,10 @@ require 'yaml'
 # Wire up YAML format compatibility with Rails 4.2. Makes the YAML parser call
 # `init_with` when it encounters `!ruby/hash-with-ivars:ActionController::Parameters`,
 # instead of trying to parse it as a regular hash subclass.
+# Second `load_tags` is for compatibility with Psych prior to 2.0.9 where hashes
+# were dumped without instance variables.
 YAML.load_tags['!ruby/hash-with-ivars:ActionController::Parameters'] = 'ActionController::Parameters'
+YAML.load_tags['!ruby/hash:ActionController::Parameters'] = 'ActionController::Parameters'
 
 module ActionController
   # Raised when a required parameter is missing.
@@ -599,14 +602,18 @@ module ActionController
 
     def init_with(coder) # :nodoc:
       if coder.map['elements']
-        # YAML's Hash subclass format from Rails 4.2, where keys and values
+        # YAML 2.0.9's Hash subclass format from Rails 4.2, where keys and values
         # were stored under an elements hash and `permitted` within an ivars hash.
         @parameters = coder.map['elements'].with_indifferent_access
         @permitted  = coder.map['ivars'][:@permitted]
-      else
+      elsif coder.map['parameters']
         # YAML's Object format. Only needed because of the format
         # backwardscompability above, otherwise equivalent to YAML's initialization.
         @parameters, @permitted = coder.map['parameters'], coder.map['permitted']
+      else
+        # YAML 2.0.8's format where hash instance variables weren't stored.
+        @parameters = coder.map.with_indifferent_access
+        @permitted  = false
       end
     end
 
diff --git a/actionpack/test/controller/parameters/serialization_test.rb b/actionpack/test/controller/parameters/serialization_test.rb
index 5d389f5a4c..84193e304a 100644
--- a/actionpack/test/controller/parameters/serialization_test.rb
+++ b/actionpack/test/controller/parameters/serialization_test.rb
@@ -20,13 +20,26 @@ class ParametersSerializationTest < ActiveSupport::TestCase
     assert_not roundtripped.permitted?
   end
 
-  test 'yaml backwardscompatible with hash inheriting parameters' do
-    assert_equal ActionController::Parameters.new(key: :value), YAML.load(<<-end_of_yaml.strip_heredoc)
+  test 'yaml backwardscompatible with psych 2.0.8 format' do
+    params = YAML.load <<-end_of_yaml.strip_heredoc
+      --- !ruby/hash:ActionController::Parameters
+      key: :value
+    end_of_yaml
+
+    assert_equal :value, params[:key]
+    assert_not params.permitted?
+  end
+
+  test 'yaml backwardscompatible with psych 2.0.9+ format' do
+    params = YAML.load(<<-end_of_yaml.strip_heredoc)
       --- !ruby/hash-with-ivars:ActionController::Parameters
       elements:
         key: :value
       ivars:
         :@permitted: false
     end_of_yaml
+
+    assert_equal :value, params[:key]
+    assert_not params.permitted?
   end
 end