{"action":"created","issue":{"url":"https://api.github.com/repos/lotus/controller/issues/67","labels_url":"https://api.github.com/repos/lotus/controller/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/lotus/controller/issues/67/comments","events_url":"https://api.github.com/repos/lotus/controller/issues/67/events","html_url":"https://github.com/lotus/controller/issues/67","id":52930607,"number":67,"title":"Make parameter types required","user":{"login":"stevehodgkiss","id":62331,"avatar_url":"https://avatars.githubusercontent.com/u/62331?v=3","gravatar_id":"","url":"https://api.github.com/users/stevehodgkiss","html_url":"https://github.com/stevehodgkiss","followers_url":"https://api.github.com/users/stevehodgkiss/followers","following_url":"https://api.github.com/users/stevehodgkiss/following{/other_user}","gists_url":"https://api.github.com/users/stevehodgkiss/gists{/gist_id}","starred_url":"https://api.github.com/users/stevehodgkiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevehodgkiss/subscriptions","organizations_url":"https://api.github.com/users/stevehodgkiss/orgs","repos_url":"https://api.github.com/users/stevehodgkiss/repos","events_url":"https://api.github.com/users/stevehodgkiss/events{/privacy}","received_events_url":"https://api.github.com/users/stevehodgkiss/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lotus/controller/labels/discussion","name":"discussion","color":"207de5"}],"state":"open","locked":false,"assignee":{"login":"jodosha","id":5089,"avatar_url":"https://avatars.githubusercontent.com/u/5089?v=3","gravatar_id":"","url":"https://api.github.com/users/jodosha","html_url":"https://github.com/jodosha","followers_url":"https://api.github.com/users/jodosha/followers","following_url":"https://api.github.com/users/jodosha/following{/other_user}","gists_url":"https://api.github.com/users/jodosha/gists{/gist_id}","starred_url":"https://api.github.com/users/jodosha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jodosha/subscriptions","organizations_url":"https://api.github.com/users/jodosha/orgs","repos_url":"https://api.github.com/users/jodosha/repos","events_url":"https://api.github.com/users/jodosha/events{/privacy}","received_events_url":"https://api.github.com/users/jodosha/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2014-12-26T16:29:18Z","updated_at":"2015-01-28T11:29:41Z","closed_at":null,"body":"For example, `param :id, Integer`\r\n\r\nCoercing user input into an expected type is a good practice. Without specifying a type, based on what the parser in rack gives you, you could end up with a string, array, hash, nil or a tempfile. It would be great if lotus made developers think about this and provided guarantees that the parameter would be either the given type or nil.\r\n\r\nRails has had vulnerabilities in the past that would have been non-issues if the input was coerced into an expected type before passing it along to ActiveRecord [1].\r\n\r\nThoughts?\r\n\r\n[1] https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/t1WFuuQyavI"},"comment":{"url":"https://api.github.com/repos/lotus/controller/issues/comments/71819321","html_url":"https://github.com/lotus/controller/issues/67#issuecomment-71819321","issue_url":"https://api.github.com/repos/lotus/controller/issues/67","id":71819321,"user":{"login":"jodosha","id":5089,"avatar_url":"https://avatars.githubusercontent.com/u/5089?v=3","gravatar_id":"","url":"https://api.github.com/users/jodosha","html_url":"https://github.com/jodosha","followers_url":"https://api.github.com/users/jodosha/followers","following_url":"https://api.github.com/users/jodosha/following{/other_user}","gists_url":"https://api.github.com/users/jodosha/gists{/gist_id}","starred_url":"https://api.github.com/users/jodosha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jodosha/subscriptions","organizations_url":"https://api.github.com/users/jodosha/orgs","repos_url":"https://api.github.com/users/jodosha/repos","events_url":"https://api.github.com/users/jodosha/events{/privacy}","received_events_url":"https://api.github.com/users/jodosha/received_events","type":"User","site_admin":false},"created_at":"2015-01-28T11:29:41Z","updated_at":"2015-01-28T11:29:41Z","body":"@Emily Thanks for your explanation. I agree that this is a good practice but make it mandatory is an overhead for developers that I don't want to add to the framework.\r\n\r\nFrom real world applications that we are building, params aren't handled by Lotus at all.\r\nSome of them are HTTP API apps that demand to already in place objects to filter those. Other will prefer to delegate this responsibility to Interactors (aka Service Objects), for the sake of DRY the code and let it to be reused by several consumers like Web app, HTTP API, background workers, console.\r\n\r\nI think that @stevehodgkiss idea is different: if and only if a developer whitelists params, only in that case she or he must declare a Ruby type."}}