FindMassAssignment

A Rails plugin to find likely mass assignment vulnerabilities

The find_mass_assignment Rake task defined by the plugin finds likely mass assignment problems in Rails projects.

The method is to scan the controllers for likely mass assignment, and then find the corresponding models that don't have attr_accessible defined. Any time that happens, it's a potential problem.

Install this plugin as follows:

$ script/plugin install git://github.com/mhartl/find_mass_assignment.git

Example

Suppose line 17 of the Users controller is

@user = User.new(params[:user])

but the User model doesn't define attr_accessible. Then we get the output

$ rake find_mass_assignment

/path/to/app/controllers/users_controller.rb
  17  @user = User.new(params[:user])

This indicates that the User model has a likely mass assignment vulnerability.

Copyright

Copyright (c) 2008 Michael Hartl, released under the MIT license