converts hashes in arrays of unfiltered params to unpermitted params [closes #185, closes #159]

Author: fxn

lib/action_controller/parameters.rb

@@ -111,11 +111,18 @@ def convert_value(value)
     private
 
       def convert_hashes_to_parameters(key, value)
-        if value.is_a?(Parameters) || !value.is_a?(Hash)
+        converted = convert_value_to_parameters(value)
+        self[key] = converted unless converted.equal?(value)
+        converted
+      end
+
+      def convert_value_to_parameters(value)
+        if value.is_a?(Array)
+          value.map { |_| convert_value_to_parameters(_) }
+        elsif value.is_a?(Parameters) || !value.is_a?(Hash)
           value
         else
-          # Convert to Parameters on first access
-          self[key] = self.class.new(value)
+          self.class.new(value)
         end
       end
 

test/parameters_permit_test.rb

@@ -333,4 +333,11 @@ def assert_filtered_out(params, key)
     assert_nil            params[:properties]["1"]
     assert_equal "prop0", params[:properties]["0"]
   end
+
+  test 'hashes in array values get wrapped' do
+    params = ActionController::Parameters.new(foo: [{}, {}])
+    params[:foo].each do |hash|
+      assert !hash.permitted?
+    end
+  end
 end