Merge pull request rails#43883 from rails/dup-converted-arrays

Dup arrays that get "converted"

Author: tenderlove

actionpack/lib/action_controller/metal/strong_parameters.rb

@@ -963,7 +963,7 @@ def convert_value_to_parameters(value)
         when Array
           return value if converted_arrays.member?(value)
           converted = value.map { |_| convert_value_to_parameters(_) }
-          converted_arrays << converted
+          converted_arrays << converted.dup
           converted
         when Hash
           self.class.new(value)

actionpack/test/controller/parameters/parameters_permit_test.rb

@@ -253,6 +253,19 @@ def walk_permitted(params)
     assert_not_predicate permitted[:users].last, :permitted?
   end
 
+  test "grow until set rehashes" do
+    params = ActionController::Parameters.new(users: [{ id: 1 }])
+
+    permitted = params.permit(users: [:id])
+    permitted[:users] << { injected: 1 }
+    20.times { |i|
+      list = ["foo#{i}"]
+      permitted[:xx] = list
+      assert_equal permitted[:xx], list
+    }
+    assert_not_predicate permitted[:users].last, :permitted?
+  end
+
   test "fetch doesn't raise ParameterMissing exception if there is a default" do
     assert_equal "monkey", @params.fetch(:foo, "monkey")
     assert_equal "monkey", @params.fetch(:foo) { "monkey" }