rubocop
diff --git a/‎lib/rubocop/cop/rails/strong_parameters_expect.rb‎
Lines changed: 6 additions & 0 deletions b/‎lib/rubocop/cop/rails/strong_parameters_expect.rb‎
Lines changed: 6 additions & 0 deletions
@@ -29,6 +29,12 @@ module Rails
       #   from an array of nested hashes, so it always generates the single-hash form, which can turn
       #   a previously successful request into a failure.
       #
+      #   It is also unsafe when `params[:key]` is passed to a finder method such as `find`, because
+      #   `find` accepts an array of IDs. `Model.find(params[:id])` loads every record for an array of IDs,
+      #   but the corrected `Model.find(params.expect(:id))` raises `ActionController::ParameterMissing`
+      #   for an array value, since `expect` requires a scalar. The cop cannot tell a scalar ID from
+      #   an array of IDs, so the autocorrection can turn a previously successful request into a failure.
+      #
       # @example
       #
       #   # bad
Original file line number	Diff line number	Diff line change
`@@ -29,6 +29,12 @@ module Rails`
`29`	`29`	`# from an array of nested hashes, so it always generates the single-hash form, which can turn`
`30`	`30`	`# a previously successful request into a failure.`
`31`	`31`	`#`
	`32`	+ # It is also unsafe when `params[:key]` is passed to a finder method such as `find`, because
	`33`	+ # `find` accepts an array of IDs. `Model.find(params[:id])` loads every record for an array of IDs,
	`34`	+ # but the corrected `Model.find(params.expect(:id))` raises `ActionController::ParameterMissing`
	`35`	+ # for an array value, since `expect` requires a scalar. The cop cannot tell a scalar ID from
	`36`	`+ # an array of IDs, so the autocorrection can turn a previously successful request into a failure.`
	`37`	`+ #`
`32`	`38`	`# @example`
`33`	`39`	`#`
`34`	`40`	`# # bad`