converts hashes in arrays of unfiltered params to unpermitted params [fixes #13382]

actionpack/CHANGELOG.md

+*   Converts hashes in arrays of unfiltered params to unpermitted params.
+
+    Fixes #13382
+
+    *Xavier Noria*
+
 *   New config option to opt out of params "deep munging" that was used to
     address security vulnerability CVE-2013-0155. In your app config:
 

actionpack/lib/action_controller/metal/strong_parameters.rb

@@ -330,11 +330,18 @@ def permitted=(new_permitted)
 
     private
       def convert_hashes_to_parameters(key, value)
-        if value.is_a?(Parameters) || !value.is_a?(Hash)
+        converted = convert_value_to_parameters(value)
+        self[key] = converted unless converted.equal?(value)
+        converted
+      end
+
+      def convert_value_to_parameters(value)
+        if value.is_a?(Array)
+          value.map { |_| convert_value_to_parameters(_) }
+        elsif value.is_a?(Parameters) || !value.is_a?(Hash)
           value
         else
-          # Convert to Parameters on first access
-          self[key] = self.class.new(value)
+          self.class.new(value)
         end
       end
 

actionpack/test/controller/parameters/parameters_permit_test.rb

@@ -153,6 +153,13 @@ def assert_filtered_out(params, key)
     assert_equal nil, params[:foo]
   end
 
+  test 'hashes in array values get wrapped' do
+    params = ActionController::Parameters.new(foo: [{}, {}])
+    params[:foo].each do |hash|
+      assert !hash.permitted?
+    end
+  end
+
   test "fetch doesnt raise ParameterMissing exception if there is a default" do
     assert_equal "monkey", @params.fetch(:foo, "monkey")
     assert_equal "monkey", @params.fetch(:foo) { "monkey" }