Use StrongParameters only for task_params

app/controllers/maintenance_tasks/tasks_controller.rb

@@ -26,9 +26,9 @@ def show
     # Runs a given Task and redirects to the Task page.
     def run
       task = Runner.run(
-        name: task_params.fetch(:id),
-        csv_file: task_params[:csv_file],
-        params: task_params[:task_params].to_h,
+        name: params.fetch(:id),
+        csv_file: params[:csv_file],
+        params: task_params,
       )
       redirect_to(task_path(task))
     rescue ActiveRecord::RecordInvalid => error
@@ -40,9 +40,9 @@ def run
     private
 
     def task_params
-      params_to_exclude = ["_method", "commit", "authenticity_token"]
-      params.reject { |param| params_to_exclude.include?(param) }
-        .permit(:id, :csv_file, task_params: {})
+      return {} unless params[:task_params].present?
+      task_attributes = Task.named(params[:id]).attribute_names
+      params.require(:task_params).permit(*task_attributes).to_h
     end
 
     def set_refresh

app/models/maintenance_tasks/runner.rb

@@ -37,6 +37,8 @@ def initialize(run)
     #   for the Task to iterate over when running, in the form of an attachable
     #   (see https://edgeapi.rubyonrails.org/classes/ActiveStorage/Attached/One.html#method-i-attach).
     #   Value is nil if the Task does not use CSV iteration.
+    # @param params [Hash] the parameters to make accessible to the Task and to
+    #   persist to the Run.
     #
     # @return [Task] the Task that was run.
     #