rails/rails — pull request #8132 by bquorning (2012-11-06 20:50:24+00:00)
Title: Permitted should be sticky on #slice

In rails/strong_parameters#57, I filed a bug report:

------------

#### #permitted? survives :except, but not :slice

I would expect that calling `:slice` on a permitted Parameters hash would return another permitted hash, just as `:except` does. But no:

```
> params = ActionController::Parameters.new(:foo => 42, :bar => 1337).permit(:foo, :bar)
=> {"foo"=>42, "bar"=>1337}
> params.except(:bar).permitted?
=> true
> params.slice(:foo).permitted?
=> false
```

Is this a feature, or is it a bug?

------------

DHH et al confirmed that it's a bug. I made a pull request rails/strong_parameters#58, which got merged in, and @rafaelfranca asked me to open a pull request for Rails core as well. Here is the description of the original pull request (with SHAs changed to match the current pull request):

------------

#### Permitted should be sticky when calling slice

This pull request solves 3 different things:

1. Some of the parameters_taint tests were broken. Fixed in 5b3b9b0ebcbe35038adaf7b1636032e6f436ed1c
1. The "permitted is sticky" tests are actually testing that "tainted is sticky". "Tainted" seems to not be used anymore, so I changed their titles to "not permitted is sticky" in 93eaffe59b713e94424212540a8788f0b273f8eb – and added a test for #except in 1a0f14e0453d3a36f134989752721292aed54892
1. I made a set of new "permitted is sticky" tests, basically inverted copies of the existing tests, only testing on a `permitted` object: 478d80fd5788a4b3e7c8482bfd3713eef7d00884 – with the #slice bug fixed in 344364990436d9fcb7e77d5deb1beeb9c34a2b85

------------