{"push_id":3028815317,"size":1,"distinct_size":1,"ref":"refs/heads/mb-lg-746","head":"5f7a9f8946f73e658d59fed4fbcedfc3b860ca31","before":"2004626b061caa73346fc59b168061de43ecb45d","commits":[{"sha":"5f7a9f8946f73e658d59fed4fbcedfc3b860ca31","author":{"name":"Moncef Belyamani","email":"36ad201e2dc6811747e8f5e53a9e31df2465a10d@gsa.gov"},"message":"LG-746 Return 400 error for invalid String params\n\n**Why**:\nWhen a controller uses Strong Parameters such as:\n`params.require(:user).permit(:email)`, the `user` param is assumed to\nbe a Hash, but it's easy for a pentester (for example) to set the\n`user` param to a String instead, which by default would raise a 500\nerror because the String class doesn't respond to `permit`.\n\n**How**:\nTo get around that, we monkey patched the Ruby String class to raise an\ninstance of `ActionController::ParameterMissing`, which will return a\n400 error. 500 errors can potentially page people in the middle of the\nnight, whereas 400 errors don't.\n\nNote that Devise handles this scenario gracefully in SessionsController,\nbut because it determines whether or not to call `permit` based on\nwhether or not the object responds to `permit`, the Devise code will\nend up calling `permit` because all Strings respond to it now after our\nmonkey patch. This is why the `invalid_sign_in_params_spec` had to\nchange.","distinct":true,"url":"https://api.github.com/repos/18F/identity-idp/commits/5f7a9f8946f73e658d59fed4fbcedfc3b860ca31"}]}
{"actor":{"display_login":"monfresh"}}