title: Rails 4 parameters; how to whitelist a param to a set of values
body: <p>I have already read some posts, such as <a href="https://stackoverflow.com/questions/28541432">Value whitelist using strong parameters in Rails 4</a>, but it's not quite what I need.</p>
  
  <p>I have a controller which takes an ID and loads a model. It also optionally takes a query string param (<code>style</code>) which can be one of 3 values, <code>small</code>, <code>medium</code> or <code>large</code>. This is passed to a method on the model which uses it to fetch an attached image (using paperclip). I noticed that if I pass an invalid param (eg <code>style=wibble</code>), then I get a 400 error and a notice that the internal file path doesn't exist. Brakeman also notes this as a security issue...</p>
  
  <pre><code>def show
    style = params[:style] || :medium
  
    thing = Model.find(params[:id])
  
    path = "#{Rails.root}/public#{thing.image_url(style)}"
    content_type = thing.image.content_type || 'image/png'
    send_file path, type: content_type, disposition: 'inline'
  end
  </code></pre>
  
  <p>We use <a href="http://api.rubyonrails.org/classes/ActionController/Parameters.html" rel="noreferrer">ActionController Parameters</a> elsewhere to great effect; but I cannot see how that could "whitelist" a parameters options? Everywhere I have seen says to use a model validator, but that's assuming I'm submitting a parameter to update a model, which I am not.</p>
  
  <p>I'm aware I could do something like:</p>
  
  <pre><code>return head :not_found unless %w(small medium large).include? style
  </code></pre>
  
  <p>Is this the best way?</p>