Remove `options` assignment from ExtractsPath

This assignment is only used by the Projects::NetworkController, so
we're needlessly assigning this very generically-named instance variable
on every controller which includes `ExtractsPath`, which is quite a few.

Further, the way we were passing this hash to
`HashWithIndifferentAccess` caused the following deprecation warning
after upgrading to Rails 5:

    DEPRECATION WARNING: #to_hash unexpectedly ignores parameter
    filtering, and will change to enforce it in Rails 5.1. Enable
    `raise_on_unfiltered_parameters` to respect parameter filtering,
    which is the default in new applications. For the existing
    deprecated behaviour, call #to_unsafe_h instead. (called from new at
    lib/extracts_path.rb:116)

app/controllers/projects/network_controller.rb

@@ -8,6 +8,7 @@ class Projects::NetworkController < Projects::ApplicationController
   before_action :require_non_empty_project
   before_action :assign_ref_vars
   before_action :authorize_download_code!
+  before_action :assign_options
   before_action :assign_commit
 
   def show
@@ -29,10 +30,13 @@ class Projects::NetworkController < Projects::ApplicationController
     render
   end
 
+  def assign_options
+    @options = params.permit(:filter_ref, :extended_sha1)
+  end
+
   def assign_commit
-    return if params[:extended_sha1].blank?
+    return if @options[:extended_sha1].blank?
 
-    @options[:extended_sha1] = params[:extended_sha1]
     @commit = @repo.commit(@options[:extended_sha1])
   end
 

lib/extracts_path.rb

@@ -110,11 +110,6 @@ module ExtractsPath
   # resolved (e.g., when a user inserts an invalid path or ref).
   # rubocop:disable Gitlab/ModuleWithInstanceVariables
   def assign_ref_vars
-    # assign allowed options
-    allowed_options = ["filter_ref"]
-    @options = params.select {|key, value| allowed_options.include?(key) && !value.blank? }
-    @options = HashWithIndifferentAccess.new(@options)
-
     @id = get_id
     @ref, @path = extract_ref(@id)
     @repo = @project.repository