The new params.expect method in Rails 8 improves parameter filtering, addressing issues with malformed input and enhancing security. It provides a cleaner, more explicit way to enforce the structure and...

...types of incoming parameters. What changed Replaces require and permit: Combines both methods for concise parameter validation. Explicit Array Handling: Requires double array syntax to define arrays of hashes, improving...

...If different, it would redirect users to the generated/expected path. expected_path = url_for(params.to_unsafe_h) # ❌ this is not safe! if expected_path != request.original_fullpath redirect_to expected_path...

...an Open Redirect vulnerability. It's as simple as passing a host=evil.tld URL parameter. Rails would see url_for(..., host: "evil.tld") and happily generate a URL to that foreign...

Rails' Strong Parameters enable you to allow only specific values from request params to e.g. avoid mass assignment. Usually, you say something like params.permit(:email, :password) and any extra parameters...

What is permit! and why is it dangerous? However, there is also params.permit! which permits everything from the params. There are situations where this is acceptable/desirable but permit...

...updates have shown that people make incorrect assumptions about the possible contents of the params hash. Just don't make any! Treat it as what it is: potentially unsafe user...

...input. For example: /pages/edit?foo= --> params == {:foo => ""} /pages/edit?foo --> params == {:foo => nil} /pages/edit?foo[] --> params == {:foo => [nil]} # at least in older rails 3 and in rails 2.x

end end This is often, but not always the same as checking for params[:format] == :xls, so don't rely on this when e.g. one format checks for authorization...

...and the other doesn't. params[:format] is only set when a user explicitly puts a .xls at the end of the URL. The format.xls block also responds when the...

= form.collection_check_boxes :author_ids, Author.all, :id, :name_with_initial How generated form params look like If you have authors with the IDs 1, 2 and 3, the check...

...uncheck all the check boxes. If this hidden input wasn't there, the form param author_ids[] would be missing from the params entirely, and the list would not be...

This card describes how to pass an array with multiple element to a JavaScript function, so that the first array...

URLs can transport key/value pairs ("parameters") using this syntax: /path?foo=bar If the value is blank, mind these subtle differences: URL Meaning /path?foo= Parameters have a key foo...

...Its value is an empty string. /path?foo Parameters have a key foo. Its value is null. /path Parameters have no key foo...

Be careful when using params.merge as params is a HashWithIndifferentAccess. Why? Usually this should not be an issue but it turns crazy if you try to include associated models deeper...

options = params.merge(:include => { :user => :avatar }) Post.paginate options When inspecting the merged params you will get something like this: { :include=> { "user" => :avatar }, :page => 23 } Here the :user symbol...

Rails' params hash contains any request parameters (URL parameters or request payload) as well as routing parameters like :controller, :action, or :id. To access only URL parameters, use request.query_parameters...

...Routing params are available through request.path_parameters. # On /users?query=Bob&page=2 >> request.params => {"page"=>"2", "query"=>"Bob", "controller"=>"users", "action"=>"index"} >> request.query_parameters => {"page"=>"2", "query"=>"Bob"} >> request.path_parameters...

There is no build in functionally in jQuery and Prototype to extract params from a url. You can use this library (not tested): jquery-deparam Use Unpoly and the following...

You cannot say this because url_for only takes one parameter: url_for(@deal, :tab => 'general') # won't work Just use polymorphic_url instead: polymorphic_url(@deal, :tab => 'general...

Rails plugin which adds a convenient way to override attr_accessible protection.... You can mark certain attributes as trusted for...

...ApplicationController def edit load_user 3.times { @user.tasks.build } end def update load_user @user.attributes = user_params if @user.save flash[:notice] = 'User saved successfully.' redirect_to(edit_variant_1_user_path(@user...

...could not be saved.' render :edit end end private def load_user @user = User.find(params[:id]) end def user_params params.require(:user).permit( :full_name, tasks_attributes: [ :id, :title, :_destroy...

...to_return(:body => 'fake body') RestClient.get('http://host/api') WebMock.should have_requested(:get ,'http://host/api') Params are tricky Testing for request params is a little tricky because Rails hides details about...

...how HTTP works. In particular GET requests encode their params in the URL while POST, PUT and DELETE requests encode their params in the body. Neither WebMock nor RestClient will...

Rails wraps your parameters into an interface called StrongParameters. In most cases, your form submits your data in a nested structure which goes hand in hand with the strong parameters...

...X POST -d "user[name]=bob" https://example.com/users class UsersController def create User.create!(params.expect(user: [:name])) # Or User.create!(params.require(:user).permit(:name)) end end This works well most of...

...IDs from the user You should also check the received signed IDs from form params to not allow a user to upload a file from another user in case they...

ActiveStorage::Blob.find_signed(signed_id) blob.present? && blob.user.present? && blob.user == user end # Some UserController def user_params permitted = params.require(:user).permit(invoice_signed_ids: []) # Filter after permitting permitted[:invoice_signed_ids] = permitted.select...

...modified: app/controllers/roles_controller.rb modified: app/controllers/sessions_controller.rb modified: app/controllers/users_controller.rb git diff diff --git a/app/controllers/movies/merges_controller.rb b/app/controllers/movies/merges_controller.rb def merge_params - params.require(:movie_merge).permit(:source_movie_id, :target_movie_id) - - rescue ActionController::ParameterMissing - {} + merge_params...

...params[:movie_merge] + merge_params ? merge_params.permit(:source_movie_id, :target_movie_id) : {} end end diff --git a/app/controllers/movies_controller.rb b/app/controllers/movies_controller.rb def create - build_movie - save_movie or render :new + if @movie.save + redirect...

load_note @note.destroy! redirect_to :notes end private def load_note @note ||= note_scope.find(params[:id]) end def build_note @note ||= note_scope.build @note.attributes = note_params end def note_params params.require...

:title, :text, :published, ) rescue ActionController::ParameterMissing {} end def note_scope # Restrict what the user may access by returning a scope with conditions. Note.all end def load_notes

Slow, non-parallel implementation class GroupsController < ApplicationController def members group_ids = params[:group_ids].split(',') group_ids_and_html = {} group_ids.each do |group_id| group = load_group(group...

end end Faster implementation with Parallel class GroupsController < ApplicationController def members group_ids = params[:group_ids].split(',') group_ids_and_html = Parallel.map(group_ids) do |group_id| # <- Here is...

...form_for helper will use a workaround to send POST requests with a _method param to avoid this issue for PATCH/DELETE. If you make requests yourself, watch out for the...

...lets you control the HTTP method used for routing by POSTing with a _method param. In JS this would be: fetch('/foo', { method: 'POST', body: new URLSearchParams({ _method: 'PATCH' }) });

...Binding (found in the IDP metadata). The LogoutRequest is contained in the redirect URL params as an URL, base64 encoded XML document. The Browser follows the redirect to the IDP...

...redirects the user back the app. The LogoutResponse is contained in the redirect URL params as a URL, base64 encoded xml document. The URL for this redirect needs to be...