False positive: Mass assignment when using a filtered hash

[brynary]

You all asked for false positive reports so here we go. :wink: Here's a Mass Assignment false positive I found today:

Bill.find(params[:id]).update_attributes(bill_params.only("content", "amount_cents"))

In this case, the developer is using Hash#only to filter params (even though strong_parameters is not in use in this repo).

On the plus side, this was flagged as "Weak" confidence.

[presidentbeef]

My guess is Brakeman doesn't know what bill_params is, and is warning because the code is doing a mass assignment, period. Otherwise, you would be getting a high confidence warning and probably be more disappointed. I suppose Brakeman could check for only or slice, since those signal intent.

[brynary]

Yeah, agreed checking for only or slice would be the way to improve this. I'm not quite sure it's worth it in the wake of strong_parameters, but wanted to report nonetheless.

[presidentbeef]

I appreciate it!