Problem

The Devise::PasswordsController uses unsanitized resource_params during password reset, which could lead to security issues.

Proposal

• Add a new :reset_password action to the DEFAULT_PERMITTED_ATTRIBUTES

DEFAULT_PERMITTED_ATTRIBUTES = {
      sign_in: [:password, :remember_me],
      sign_up: [:password, :password_confirmation],
      account_update: [:password, :password_confirmation, :current_password]
      reset_password: [:reset_password_token, :password, :password_confirmation]
    }

• Use it in the Devise::PasswordsController.

    def resource_params
      devise_parameter_sanitizer.sanitize(:reset_password)
    end

This will ensure the parameters used in the Devise::PasswordsControllerare sanitized, maintaining consistency with other controllers like RegistrationController and SessionController.