ryanlowe / audit_mass_assignment fork watch download tarball
public
Rubygem
Forks0Right
Watchers10Right
Description: Checks Ruby on Rails models for use of the attr_accessible white list.
Homepage: http://www.disruptiveagility.com/plugin/audit_mass_assignment
Clone URL: git://github.com/ryanlowe/audit_mass_assignment.git 
bugfix: failures was size instead of array of failed classes
ryanlowe (author)
Wed May 28 01:03:26 -0700 2008
commit  710411e919f428f0c07313caba07dbc7b078b2e2
tree    355dea58e00e2359dae44f7f1688d6afe838fcfb
parent  24307964eb790e6a32f9e5fd1d074d2650c39c8e
100644 36 lines (21 sloc) 1.169 kb
raw blame history 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

Moved to GitHub from Google Code on May 1, 2008
Was hosted at http://code.google.com/p/audit-mass-assignment/
 
= audit_mass_assignment plugin for Ruby on Rails
 
  The audit_mass_assignment Ruby on Rails plugin contains a rake task that
  checks the models in your project for the attr_accessible whitelist approach
  for protecting against "mass assignment" exploits.  It does not check for
  use of attr_protected.
 
== Installation
 
  gem install ryanlowe-audit_mass_assignment --source http://gems.github.com/
 
== Usage
 
  $ rake audit:mass_assignment
 
== Notes
 
  If you want to protect ALL attributes in your model use:
  
    attr_accessible nil
 
  Why are "mass assignment" exploits a danger to Rails applications? See these links:
  
  1. rorsecurity.info: Do not create records directly from form parameters
     http://www.rorsecurity.info/2007/03/20/do-not-create-records-directly-from-form-parameters/
  
  2. Railscasts: Hackers Love Mass Assignment
     http://railscasts.com/episodes/26
  
  3. Rails Manual: Typical mistakes in Rails applications: Creating records directly from form parameters
     http://manuals.rubyonrails.com/read/chapter/47