rails/strong_parameters — pull request #97 by HonoreDB (2013-02-12 18:42:42+00:00)
Title: Strongly typed parameters

Allowing a whitelist of scalars can lead to errors and vulnerabilities, as noted recently in https://groups.google.com/forum/?hl=en&fromgroups=#!topic/rubyonrails-security/ZOdH5GH5jCU . There is generally only one expected type for a given parameter, and it's usually String since that's all you can do with a URI. `find_by_token(0)` may match `"c88f874ec56b3f314c2efc032d563acb8b07790f"`, or `find_by_id("a")` may match `0`.

The default behavior I'd rather see is to require a type declaration in the `:permit` call if the expected type is anything other than String. In the special case where a hashed ActiveRecord model is being passed, the expected types can be derived from the model's `columns` method.

I've tried to implement this here; see the modified README for the syntax. Curious what the rails community thinks.