Skip to content

Fix Rails/StrongParametersExpect to allow safe navigation operator on optional params#1629

Merged
koic merged 1 commit into
rubocop:masterfrom
lucasmazza:fix/strong-parameters-expect-safe-navigation
May 25, 2026
Merged

Fix Rails/StrongParametersExpect to allow safe navigation operator on optional params#1629
koic merged 1 commit into
rubocop:masterfrom
lucasmazza:fix/strong-parameters-expect-safe-navigation

Conversation

@lucasmazza
Copy link
Copy Markdown
Contributor

&. is semantically equivalent to || nil — both communicate that the developer expects the param may be absent. The cop already exempts || parent nodes via or_type?; this adds the same guard for csend_type? (safe navigation receiver).

Without this fix, params[:key]&.downcase is autocorrected to params.expect(:key).downcase, silently changing behavior: a missing param goes from returning nil to raising ActionController::ParameterMissing (400). The developer used &. precisely to handle the nil case — the autocorrect removes that intent.

The guard is scoped to parent.receiver == node so Model&.find(params[:id]) (where params[:id] is an argument, not the receiver of the safe navigation) is still correctly flagged.


Before submitting the PR make sure the following are checked:

  • The PR relates to only one subject with a clear title and description in grammatically correct, complete sentences.
  • Wrote good commit messages.
  • Commit message starts with [Fix #issue-number] (if the related issue exists).
  • Feature branch is up-to-date with master (if not - rebase it).
  • Squashed related commits together.
  • Added tests.
  • Ran bundle exec rake default. It executes all tests and runs RuboCop on its own code.
  • Added an entry (file) to the changelog folder named {change_type}_{change_description}.md if the new code introduces user-observable changes. See changelog entry format for details.
  • If this is a new cop, consider making a corresponding update to the Rails Style Guide.

@koic
Copy link
Copy Markdown
Member

koic commented May 25, 2026

@lucasmazza This looks good to me. Can you squash your commits into one?

… optional params

`&.` is semantically equivalent to `|| nil` — both communicate that the developer expects
the param may be absent. The cop already exempted `||` parent nodes via `or_type?`;
this adds the same guard for `csend_type?` (safe navigation receiver).

Without this fix, `params[:key]&.downcase` is autocorrected to
`params.expect(:key).downcase`, silently changing behavior: a missing param goes from
returning `nil` to raising `ActionController::ParameterMissing` (400). The developer
used `&.` precisely to handle the nil case — the autocorrect removes that intent.

The guard is scoped to `parent.receiver == node` so `Model&.find(params[:id])` (where
`params[:id]` is an argument, not the receiver of the safe navigation) is still
correctly flagged.
@lucasmazza lucasmazza force-pushed the fix/strong-parameters-expect-safe-navigation branch from ccf0373 to 0ea9fbc Compare May 25, 2026 18:00
@lucasmazza
Copy link
Copy Markdown
Contributor Author

@koic done

@koic koic merged commit dbb2e27 into rubocop:master May 25, 2026
17 checks passed
@koic
Copy link
Copy Markdown
Member

koic commented May 25, 2026

Thanks!

@lucasmazza lucasmazza deleted the fix/strong-parameters-expect-safe-navigation branch May 25, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants