The `permitted?` method acts like tainted for strong parameters. It is the
correct check.

On Thursday, January 16, 2014, Emily <notifications@github.com> wrote:

> In lib/origin/queryable.rb:
>
> > +
> > +    # Check if the value is secure (not passed directly from the request
> > +    # parameters).
> > +    #
> > +    # @api private
> > +    #
> > +    # @example Check the value's security.
> > +    #   selectable.check_security!(email: "testing")
> > +    #
> > +    # @param [ Object ] value The value to check.
> > +    #
> > +    # @raise [ Insecure ] If the value is params.
> > +    #
> > +    # @since 2.2.0
> > +    def check_security!(value)
> > +      raise Insecure.new(value) if value.is_a?(ActionController::Parameters)
>
> In that case, the best we can do is check if the value is
> ActionController::Parameters, as you've done. Dan said he defers to us :)
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/mongoid/origin/pull/94/files#r8938966>
> .
>