Use new `params.expect` syntax instead of `params.require` #573

jeromedalbert · 2024-09-14T09:28:06Z

Problem

PR rails/rails#51674 updated controller generator templates in the Rails codebase. But, as DHH explained, we need to do the same update to templates in jbuilder, because they are used by default for new Rails apps.

Solution

Port the changes from rails/rails#51674 to this codebase, only for Rails versions 8.0+:

Change templates to use params.expect(post: [ :title, ... ]) instead of params.require(:post).permit(:title, ...).

Notice the spaces around [ and ] in order to be compliant with rubocop-rails-omakase rules, which are enabled by default for new Rails apps.
Change templates to use @post = params.expect(:id) instead of @post = params[:id].

cc @martinemde

MatheusRich · 2024-09-14T14:47:54Z

@jeromedalbert add a Changelog entry, please

martinemde

Thanks for following up with this. I think we should not change the fetch cases. Otherwise looks good (with changelog as mentioned).

martinemde · 2024-09-14T15:42:55Z

lib/generators/rails/templates/api_controller.rb

    end

    # Only allow a list of trusted parameters through.
    def <%= "#{singular_table_name}_params" %>
+      <%- if Rails::VERSION::MAJOR >= 8 -%>
+      <%- if attributes_names.empty? -%>
+      params.expect(<%= singular_table_name %>: {})


If we replace params.fetch like this it changes the behavior. Now, even though there are no attributes expected, you must send at least one attribute or you'll get a 400 error.

I suggest changing only the case with attributes and leaving this one alone.

@martinemde This makes sense, should the same be reverted from your PR on the Rails side?

https://github.com/rails/rails/pull/51674/files#diff-b20602dd9d67c64034125da9a3708746393dd155baa893f3bae0801dfb0efe11R51

and

https://github.com/rails/rails/pull/51674/files#diff-78fc500caeccee5a125dc41b391dec245fc90864a13ba44ef5ce009887438cd7R58

You're exactly right. I submitted rails/rails#52932 to fix it. Thanks for noticing that I was in violation of my own recommendation. Thanks!

This was the purpose of params.allow. Please someone from rails core let me know if that's worth a second, more focused attempt and I can extract the original code back out.

test/scaffold_api_controller_generator_test.rb

jeromedalbert · 2024-09-14T20:30:41Z

@MatheusRich This project does not seem to have a Changelog file. 😅

After looking at this:

jbuilder/jbuilder.gemspec

Line 26 in acf44b8

    
           "changelog_uri"         => "https://github.com/rails/jbuilder/releases/tag/v#{s.version}",

It looks like changelogs are made directly from GitHub at release time: https://github.com/rails/jbuilder/releases

So I guess I'm good on my end, but let me know if I missed something.

The conversions have the unintended consequence of requiring params when none are expected on the default generated templates. Originally pointed out in rails/jbuilder#573.

The conversions have the unintended consequence of requiring params when none are expected on the default generated templates. Adds a missing test for the api controller generation. Originally pointed out in rails/jbuilder#573.

The conversions have the unintended consequence of requiring params when none are expected. Ensure generated templates work as is. Adds a missing test for the api controller generation. Originally pointed out in rails/jbuilder#573.

The conversions have the unintended consequence of requiring params when none are expected. Ensure generated templates work as is. Adds a missing test for the api controller generation. Originally pointed out in rails/jbuilder#573.

jeromedalbert mentioned this pull request Sep 14, 2024

Add Parameters#expect to safely filter and require params rails/rails#51674

Merged

4 tasks

martinemde reviewed Sep 14, 2024

View reviewed changes

Use new params.expect syntax

5d804e4

jeromedalbert force-pushed the params-expect-syntax branch from e54ef73 to 5d804e4 Compare September 14, 2024 20:14

martinemde mentioned this pull request Sep 14, 2024

Revert params.fetch to params.expect conversions in scaffold rails/rails#52932

Merged

4 tasks

dhh merged commit 1a18149 into rails:main Sep 15, 2024
12 checks passed

jeromedalbert deleted the params-expect-syntax branch September 15, 2024 22:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use new `params.expect` syntax instead of `params.require` #573

Use new `params.expect` syntax instead of `params.require` #573

jeromedalbert commented Sep 14, 2024

MatheusRich commented Sep 14, 2024

martinemde left a comment

martinemde Sep 14, 2024

jeromedalbert Sep 14, 2024 •

edited

Loading

martinemde Sep 14, 2024

martinemde Sep 14, 2024

jeromedalbert commented Sep 14, 2024 •

edited

Loading

Use new params.expect syntax instead of params.require #573

Use new params.expect syntax instead of params.require #573

Conversation

jeromedalbert commented Sep 14, 2024

Problem

Solution

MatheusRich commented Sep 14, 2024

martinemde left a comment

Choose a reason for hiding this comment

martinemde Sep 14, 2024

Choose a reason for hiding this comment

jeromedalbert Sep 14, 2024 • edited Loading

Choose a reason for hiding this comment

martinemde Sep 14, 2024

Choose a reason for hiding this comment

martinemde Sep 14, 2024

Choose a reason for hiding this comment

jeromedalbert commented Sep 14, 2024 • edited Loading

Use new `params.expect` syntax instead of `params.require` #573

Use new `params.expect` syntax instead of `params.require` #573

jeromedalbert Sep 14, 2024 •

edited

Loading

jeromedalbert commented Sep 14, 2024 •

edited

Loading