search

AaronLasseigne / active_interaction

:briefcase: Manage application specific business logic.
MIT License
2.07k stars 137 forks source link

allow hash inputs to take ActionController::Parameters #491

Closed ghost closed 2 years ago

ghost commented 3 years ago

Convert ActionController::Parameters to hash for hash inputs, the same way ActiveInteraction already converts ActionController::Parameters for overall inputs.

Previously, if params is an ActionController::Params and h is a hash input, then Interaction.run(params) would work, but Interaction.run(h: params) would raise an InvalidValueError.

This PR makes the latter case "just work".

h0jeZvgoxFepBQ2C commented 2 years ago

Can this be merged please? :D

AaronLasseigne commented 2 years ago

I don't think this is good from a security point of view. I don't mind calling to_unsafe_h on the main inputs because you have to define each input you want with a filter. We throw out everything else. In the case of a hash you could use set strip: false and pass in a bunch of params not realizing what you've got. If you use that in a mass assignment it could cause issues. That's why Rails added strong params. If someone wants to pass the params into a hash I think it might be more reasonable to make them call to_unsafe_h so they know they're avoiding strong params.