From 130370b1c872e9c7645e1c3cc26365d9dc4d90b1 Mon Sep 17 00:00:00 2001 From: Thomas Drake-Brockman Date: Sat, 19 Jan 2013 22:20:13 +0800 Subject: Added ability to raise or log on unpermitted params. --- .../action_controller/metal/strong_parameters.rb | 25 +++++++++++ actionpack/lib/action_controller/railtie.rb | 15 ++++--- .../parameters/log_on_unpermitted_params_test.rb | 50 ++++++++++++++++++++++ .../parameters/raise_on_unpermitted_params_test.rb | 33 ++++++++++++++ 4 files changed, 117 insertions(+), 6 deletions(-) create mode 100644 actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb create mode 100644 actionpack/test/controller/parameters/raise_on_unpermitted_params_test.rb (limited to 'actionpack') diff --git a/actionpack/lib/action_controller/metal/strong_parameters.rb b/actionpack/lib/action_controller/metal/strong_parameters.rb index e6e58ce6cd..317cf101b7 100644 --- a/actionpack/lib/action_controller/metal/strong_parameters.rb +++ b/actionpack/lib/action_controller/metal/strong_parameters.rb @@ -19,6 +19,20 @@ module ActionController end end + # Raised when a supplied parameter is not expected. + # + # params = ActionController::Parameters.new(a: "123", b: "456") + # params.permit(:c) + # # => ActionController::UnexpectedParameter: found unexpected keys: a, b + class UnexpectedParameters < IndexError + attr_reader :params + + def initialize(params) + @params = params + super("found unpermitted parameters: #{params.join(", ")}") + end + end + # == Action Controller \Parameters # # Allows to choose which attributes should be whitelisted for mass updating @@ -65,6 +79,7 @@ module ActionController # params["key"] # => "value" class Parameters < ActiveSupport::HashWithIndifferentAccess cattr_accessor :permit_all_parameters, instance_accessor: false + cattr_accessor :action_on_unpermitted, instance_accessor: false # Returns a new instance of ActionController::Parameters. # Also, sets the +permitted+ attribute to the default value of @@ -222,6 +237,16 @@ module ActionController end end + unpermitted_keys = self.keys - params.keys + if unpermitted_keys.any? + case self.class.action_on_unpermitted + when :log + ActionController::Base.logger.debug "Unpermitted parameters: #{unpermitted_keys.join(", ")}" + when :raise + raise ActionController::UnexpectedParameters.new(unpermitted_keys) + end + end + params.permit! end diff --git a/actionpack/lib/action_controller/railtie.rb b/actionpack/lib/action_controller/railtie.rb index 3e44155f73..bd012965c3 100644 --- a/actionpack/lib/action_controller/railtie.rb +++ b/actionpack/lib/action_controller/railtie.rb @@ -21,21 +21,24 @@ module ActionController initializer "action_controller.parameters_config" do |app| ActionController::Parameters.permit_all_parameters = app.config.action_controller.delete(:permit_all_parameters) { false } + ActionController::Parameters.action_on_unpermitted = app.config.action_controller.action_on_unpermitted_params end initializer "action_controller.set_configs" do |app| paths = app.config.paths options = app.config.action_controller - options.logger ||= Rails.logger - options.cache_store ||= Rails.cache + options.logger ||= Rails.logger + options.cache_store ||= Rails.cache - options.javascripts_dir ||= paths["public/javascripts"].first - options.stylesheets_dir ||= paths["public/stylesheets"].first + options.javascripts_dir ||= paths["public/javascripts"].first + options.stylesheets_dir ||= paths["public/stylesheets"].first # Ensure readers methods get compiled - options.asset_host ||= app.config.asset_host - options.relative_url_root ||= app.config.relative_url_root + options.asset_host ||= app.config.asset_host + options.relative_url_root ||= app.config.relative_url_root + + options.action_on_unpermitted_params ||= (Rails.env.test? || Rails.env.development?) ? :log : false ActiveSupport.on_load(:action_controller) do include app.routes.mounted_helpers diff --git a/actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb b/actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb new file mode 100644 index 0000000000..fb50dabff9 --- /dev/null +++ b/actionpack/test/controller/parameters/log_on_unpermitted_params_test.rb @@ -0,0 +1,50 @@ +require 'abstract_unit' +require 'action_controller/metal/strong_parameters' + +class LogOnUnpermittedParamsTest < ActiveSupport::TestCase + def setup + ActionController::Parameters.action_on_unpermitted = :log + end + + def teardown + ActionController::Parameters.action_on_unpermitted = false + end + + test "logs on unexpected params" do + params = ActionController::Parameters.new({ + book: { pages: 65 }, + fishing: "Turnips" + }) + + assert_logged("Unpermitted parameters: fishing") do + params.permit(book: [:pages]) + end + end + + test "logs on unexpected nested params" do + params = ActionController::Parameters.new({ + book: { pages: 65, title: "Green Cats and where to find then." } + }) + + assert_logged("Unpermitted parameters: title") do + params.permit(book: [:pages]) + end + end + + private + + def assert_logged(message) + old_logger = ActionController::Base.logger + log = StringIO.new + ActionController::Base.logger = Logger.new(log) + + begin + yield + + log.rewind + assert_match message, log.read + ensure + ActionController::Base.logger = old_logger + end + end +end \ No newline at end of file diff --git a/actionpack/test/controller/parameters/raise_on_unpermitted_params_test.rb b/actionpack/test/controller/parameters/raise_on_unpermitted_params_test.rb new file mode 100644 index 0000000000..e2933b86eb --- /dev/null +++ b/actionpack/test/controller/parameters/raise_on_unpermitted_params_test.rb @@ -0,0 +1,33 @@ +require 'abstract_unit' +require 'action_controller/metal/strong_parameters' + +class RaiseOnUnpermittedParamsTest < ActiveSupport::TestCase + def setup + ActionController::Parameters.action_on_unpermitted = :raise + end + + def teardown + ActionController::Parameters.action_on_unpermitted = false + end + + test "raises on unexpected params" do + params = ActionController::Parameters.new({ + book: { pages: 65 }, + fishing: "Turnips" + }) + + assert_raises(ActionController::UnexpectedParameters) do + params.permit(book: [:pages]) + end + end + + test "raises on unexpected nested params" do + params = ActionController::Parameters.new({ + book: { pages: 65, title: "Green Cats and where to find then." } + }) + + assert_raises(ActionController::UnexpectedParameters) do + params.permit(book: [:pages]) + end + end +end \ No newline at end of file -- cgit v1.2.3