Don't mutate the original object when using ActionController::Parameters#fetch

lib/action_controller/parameters.rb

@@ -43,7 +43,7 @@ def initialize(attributes = nil)
 
     def permit!
       each_pair do |key, value|
-        convert_hashes_to_parameters(key, value)
+        convert_hashes_to_parameters!(key, value)
         self[key].permit! if self[key].respond_to? :permit!
       end
 
@@ -75,7 +75,7 @@ def permit(*filters)
     end
 
     def [](key)
-      convert_hashes_to_parameters(key, super)
+      convert_hashes_to_parameters!(key, super)
     end
 
     def fetch(key, *args)
@@ -110,7 +110,7 @@ def convert_value(value)
 
     private
 
-      def convert_hashes_to_parameters(key, value)
+      def convert_hashes_to_parameters!(key, value)
         if value.is_a?(Parameters) || !value.is_a?(Hash)
           value
         else
@@ -119,6 +119,14 @@ def convert_hashes_to_parameters(key, value)
         end
       end
 
+      def convert_hashes_to_parameters(key, value)
+        if value.is_a?(Parameters) || !value.is_a?(Hash)
+          value
+        else
+          self.class.new(value)
+        end
+      end
+
       #
       # --- Filtering ----------------------------------------------------------
       #

test/parameters_taint_test.rb

@@ -22,6 +22,12 @@ class ParametersTaintTest < ActiveSupport::TestCase
     end
   end
 
+  test "fetch doesn't mutates the original object" do
+    value = @params.fetch(:city, { name: 'Barcelona' })
+    assert_equal value, ActionController::Parameters.new(name: 'Barcelona')
+    assert @params[:city].nil?
+  end
+
   test "not permitted is sticky on accessors" do
     assert !@params.slice(:person).permitted?
     assert !@params[:person][:name].permitted?