From 7306fe362b665b4aed1dd9de4035af9dad7137a6 Mon Sep 17 00:00:00 2001
From: Leonel Galan <leonelgalan@gmail.com>
Date: Mon, 13 Feb 2017 18:14:41 -0500
Subject: Use of ParameterFilter no longer forces `request.filtered_parameters'
 class to be Hash

- Fixes issue described on #27944
- `filtered_query_string` used an Array representation of what
semantically is a key value pair: better suited for a Hash.  Without
this change `filtered_params = original_params.class.new` returns an
Array with unintended consequences.
---
 actionpack/lib/action_dispatch/http/filter_parameters.rb |  2 +-
 actionpack/lib/action_dispatch/http/parameter_filter.rb  |  2 +-
 actionpack/test/dispatch/request_test.rb                 | 13 +++++++++++++
 3 files changed, 15 insertions(+), 2 deletions(-)

(limited to 'actionpack')

diff --git a/actionpack/lib/action_dispatch/http/filter_parameters.rb b/actionpack/lib/action_dispatch/http/filter_parameters.rb
index e584b84d92..077ab2561f 100644
--- a/actionpack/lib/action_dispatch/http/filter_parameters.rb
+++ b/actionpack/lib/action_dispatch/http/filter_parameters.rb
@@ -74,7 +74,7 @@ module ActionDispatch
       PAIR_RE = %r{(#{KV_RE})=(#{KV_RE})}
       def filtered_query_string # :doc:
         query_string.gsub(PAIR_RE) do |_|
-          parameter_filter.filter([[$1, $2]]).first.join("=")
+          parameter_filter.filter($1 => $2).first.join("=")
         end
       end
     end
diff --git a/actionpack/lib/action_dispatch/http/parameter_filter.rb b/actionpack/lib/action_dispatch/http/parameter_filter.rb
index 889f55a52a..1d2b4b902b 100644
--- a/actionpack/lib/action_dispatch/http/parameter_filter.rb
+++ b/actionpack/lib/action_dispatch/http/parameter_filter.rb
@@ -54,7 +54,7 @@ module ActionDispatch
         end
 
         def call(original_params, parents = [])
-          filtered_params = {}
+          filtered_params = original_params.class.new
 
           original_params.each do |key, value|
             parents.push(key) if deep_regexps
diff --git a/actionpack/test/dispatch/request_test.rb b/actionpack/test/dispatch/request_test.rb
index 2f9228a62d..baa4a0b3b4 100644
--- a/actionpack/test/dispatch/request_test.rb
+++ b/actionpack/test/dispatch/request_test.rb
@@ -1098,6 +1098,19 @@ class RequestParameterFilter < BaseRequestTest
     end
   end
 
+  test "parameter filter should maintain hash with indifferent access" do
+    test_hashes = [
+      [{'foo'=>'bar'}.with_indifferent_access, %w'food'],
+      [{'foo'=>'bar'}.with_indifferent_access, []]
+    ]
+
+    test_hashes.each do |before_filter, filter_words|
+      parameter_filter = ActionDispatch::Http::ParameterFilter.new(filter_words)
+      assert_instance_of ActiveSupport::HashWithIndifferentAccess,
+                         parameter_filter.filter(before_filter)
+    end
+  end
+
   test "filtered_parameters returns params filtered" do
     request = stub_request(
       "action_dispatch.request.parameters" => {
-- 
cgit v1.2.3