Use expect for nested params in auth/setup#update (#33657)

mastodon · Jan 21, 2025 · 45149cd · 45149cd
1 parent 7543c90
commit 45149cd
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/app/controllers/auth/setup_controller.rb b/app/controllers/auth/setup_controller.rb
@@ -35,6 +35,6 @@ def set_user
   end
 
   def user_params
-    params.require(:user).permit(:email)
+    params.expect(user: [:email])
   end
 end
diff --git a/spec/requests/auth/setup_spec.rb b/spec/requests/auth/setup_spec.rb
@@ -24,4 +24,15 @@
       end
     end
   end
+
+  describe 'PUT /auth/setup' do
+    before { sign_in Fabricate(:user, confirmed_at: nil) }
+
+    it 'gracefully handles invalid nested params' do
+      put '/auth/setup?user=invalid'
+
+      expect(response)
+        .to have_http_status(400)
+    end
+  end
 end