make always permitted parameters configurable

[garysweaver]

originally submitted via rails/strong_parameters#174

Was getting errors related to 'format' not being allowed as a param. Having to permit 'format' everywhere is messy, but I wasn't sure about changing S.P. to always allow format for everyone, since it is a client-supplied param and there may be some valid reason to allow control over permittance of 'format' rather than always permitting it. It seemed that just allowing NEVER_UNPERMITTED_PARAMS to be modifiable would be the best idea, so I converted it into a configuration option, using fewer double negatives ("always_permitted_parameters"). Not sure if that works for everyone or not, so this is really just a conversation starter.

[dmathieu]

👎
I'd much prefer to add format to the constant.
This might lead beginners to just allow all params everywhere for "simplicity", therefore leading to a potential security issue.

[garysweaver]

@dmathieu True, and my first inclination was to just add it to the constant, but

1. 'format' is not injected by Rails. It is request-provided and request provided data must be handled by S.P. for safety. Turning this off for format is an application-level concern.
2. Adding a configuration method allows for greater extension. There may be other application-specific data that should be allowed other than format that is deleted from params as it is retrieved in a before filter. Stopping this makes S.P. less-friendly to app developers.

[rafael]

Question, why did this never made it to the repo? Is there a workaround for this situation? I see in the code the reference to the old constant still. It would be really nice is this could be configurable.

https://github.com/rails/rails/blob/master/actionpack/lib/action_controller/metal/strong_parameters.rb#L106

Thanks !

[garysweaver]

@rafael You caught me. I pulled a magic trick with this one, and we don't talk about it.

I don't have the need for this specific feature, so I'd rather if you or someone else who cares enough about it maybe re-implement it and re-PR. Thanks!

[rafael]

@garysweaver done! :) #15933