class RuboCop::Cop::Mavenlint::UnsafeMassAssignment

Identify usages of mass assignment with potentially 'unsafe' columns allowed.

For example

class SomeModel
  attr_accessible :account_id
end

Allowing mass assignment of a foreign key column is dangerous for models that are created or updated through a publicly accessible endpoint, because the associated model isn't necessarily loaded and ran through security checks.

Constants

MSG

Public Instance Methods

on_send(node) click to toggle source
# File lib/rubocop/cop/mavenlint/unsafe_mass_assignment.rb, line 20
def on_send(node)
  return unless node.command?(:attr_accessible)

  if unsafe_names?(node)
    add_offense(node, message: MSG)
  end
end

Private Instance Methods

unsafe_names?(node) click to toggle source
# File lib/rubocop/cop/mavenlint/unsafe_mass_assignment.rb, line 30
def unsafe_names?(node)
  node.arguments.any? do |arg|
    arg.source.end_with?('_id')
  end
end