[Fix rails#51463] Raise an error when invalid :on or :except opti…

…ons are given to #resource or #resouces

actionpack/CHANGELOG.md

@@ -1,3 +1,7 @@
+*   Raise an `ArgumentError` when invalid `:on` or `:except` options are passed into `#resouce` and `#resources`.
+
+    *Joshua Young*
+
 *   Request Forgery takes relative paths into account.
 
     *Stefan Wienert*

actionpack/lib/action_dispatch/routing/mapper.rb

@@ -1175,6 +1175,11 @@ def initialize(entities, api_only, shallow, options = {})
               raise ArgumentError, ":param option can't contain colons"
             end
 
+            valid_actions = CANONICAL_ACTIONS.map(&:to_sym)
+            if (invalid_actions = (options.values_at(:only, :except).flatten.compact - valid_actions)).any?
+              raise ArgumentError, "expected :only and :except to be one or more of #{valid_actions}, got #{invalid_actions}"
+            end
+
             @name       = entities.to_s
             @path       = (options[:path] || @name).to_s
             @controller = (options[:controller] || @name).to_s

actionpack/test/controller/resources_test.rb

@@ -1109,6 +1109,28 @@ def test_singleton_resource_name_is_not_singularized
     end
   end
 
+  def test_invalid_only_option
+    expected_message = "expected :only and :except to be one or more of [:index, :create, :new, :show, :update, :destroy], got [:foo, :bar]"
+    assert_raise(ArgumentError, match: expected_message) do
+      with_routing do |set|
+        set.draw do
+          resources :products, only: [:foo, :bar]
+        end
+      end
+    end
+  end
+
+  def test_invalid_except_option
+    expected_message = "expected :only and :except to be one or more of [:index, :create, :new, :show, :update, :destroy], got [:foo]"
+    assert_raise(ArgumentError, match: expected_message) do
+      with_routing do |set|
+        set.draw do
+          resources :products, except: :foo
+        end
+      end
+    end
+  end
+
   private
     def with_restful_routing(*args)
       options = args.extract_options!