Cleaning parameters before passing them to a model

Question

I'm writing an API and want to be able to pass in the attributes of a model without prefixing them with the name of the model.

I wrote this little extension to ActiveRecord in order to make it happen:

module ActiveRecord
  class Base
    def self.filter_attributes(hash)
      hash.stringify_keys.slice(*self.accessible_attributes.to_a)
    end
  end
end

And I use it like this:

class IdeaController < ActiveRecord::Base
  def create
    @idea = Idea.create(Idea.filter_parameters(params))
    respond_with @idea
  end
end

I have two questions:

1. What do you think about the name of the method? filter_parameters() seemed to make sense, but it's a little generic.

2. Are there uses of this that I'm not thinking of and that would cause problems, such as passing in nested attributes?

Answer 1

Honsetly, I don't see any sense in your extension. Can you tell me what is the difference between

@idea = Idea.create(Idea.filter_parameters(params))

and

@idea = Idea.create(params)

mass assignment sanitizing make this code safety.