Comments (3)
The only issue is related to receiving external input and mass assigning to a model instance, which is likely to exist only in controller scenarios. Do you have any other use case where user input is expected? If that's a case, you should be able to manually instantiate the Parameters object and use permit
and brothers as in the controllers.
from strong_parameters.
@carlosantoniodasilva Thanks for your reply.
As a specific example, I've written code before in the context of callbacks, where our server would receive an id via a POST, create a background job, which then would call out to a remote endpoint url to fetch more complete json data that was used to create a new model. Usually we try to be clean and remember to sanitize the JSON we get back, but it could be easy to forget or be lazy and send the unchecked or partially checked hash on for mass assignment.
Another possible scenario is if you have a mounted rack app alongside your rails app, that is sharing the db connection and models. In such a situation it would definitely be prudent to wrap the params in the rack app as ActionController::Parameters as you have suggested.
I'm asking this because the previous (well, current) attr_accessible scheme protects against forgetting/sloppiness in such instances.
I very much like having the strong_parameters contextually filtering in this new way, I just have this one hangup I'm trying to hone so I don't make mistakes.
Thanks!
from strong_parameters.
Thanks for the examples. I think that for such scenarios, the best choice would be to either go with creating the parameters hash and permitting as necessary, or at least slicing the received args to only the ones you really want to pass along to the model, to avoid unwanted attributes. That's how I can think of contextual/case-by-case filtering, and indeed we'll have to get used to it :).
from strong_parameters.
Related Issues (20)
- Nested attributes are not permitted HOT 1
- Rails 4 migration clarification HOT 1
- Strong parameters with form_for object as: object_alias HOT 1
- No test on NEVER_UNPERMITTED_PARAMS HOT 1
- Setting a nested resource to `nil` will drop the key
- superclass mismatch for class parametermissing HOT 1
- Set polymorphic association in a manner that Rails picks up on the association add
- ActionController::Parameters.new.respond_to?(:map) returns false even though it's mappable
- How do I allow not specifically? HOT 1
- Using a number as a nested key breaks permit
- Support for non-traditional symbols (start with a number, contains a dash)? HOT 1
- Can't deserialize. undefined method `[]=' for nil:NilClass HOT 2
- Fix Travis CI builds HOT 1
- after upgrade rail 3 to 4 data inserted on Table is NULL HOT 1
- No exception raised for forbidden attributes.
- Require and permit this json HOT 1
- `permit` do not work properly when value is array
- Question - in strong_parameters is checking only key is present in params enough? HOT 2
- no way to cleanly express recursive parameters HOT 2
- Feature proposal - ActionController::Parameters#allow / ActionController::Parameters#forbid - Allowed parameter values HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from strong_parameters.