class RuboCop::Cop::Mavenlint::UnsafeMassAssignment
Identify usages of mass assignment with potentially 'unsafe' columns allowed.
For example
class SomeModel attr_accessible :account_id end
Allowing mass assignment of a foreign key column is dangerous for models that are created or updated through a publicly accessible endpoint, because the associated model isn't necessarily loaded and ran through security checks.
Constants
- MSG
Public Instance Methods
on_send(node)
click to toggle source
# File lib/rubocop/cop/mavenlint/unsafe_mass_assignment.rb, line 20 def on_send(node) return unless node.command?(:attr_accessible) if unsafe_names?(node) add_offense(node, message: MSG) end end
Private Instance Methods
unsafe_names?(node)
click to toggle source
# File lib/rubocop/cop/mavenlint/unsafe_mass_assignment.rb, line 30 def unsafe_names?(node) node.arguments.any? do |arg| arg.source.end_with?('_id') end end