Rails 4.x Mass-Assignment Errors

[phene]

I'm getting mass-assignment errors despite using the configuration option active_record.whitelist_attributes = true

https://github.com/presidentbeef/brakeman/blob/master/lib/brakeman/checks/base_check.rb#L180

[presidentbeef]

Sorry, can you be more specific about what warnings you are seeing? If Rails 4 is in use, then mass assignment is not the same as in Rails 2/3 so Brakeman doesn't warn about the same kinds of issues.

[presidentbeef]

Are you saying you are using the protected_attributes gem in Rails 4 and setting active_record.whitelist_attributes = true?

[phene]

@presidentbeef that's exactly the case. I've patched my local copy to use this logic:

    elsif version_between?("4.0.0", "4.9.9") && (!tracker.config[:gems][:protected_attributes] || (tracker.config[:rails][:active_record] &&
          tracker.config[:rails][:active_record][:whitelist_attributes] == Sexp.new(:true)))
      @mass_assign_disabled = true
    else

[presidentbeef]

If you want to send that as a pull request I'd be happy to merge.

[phene]

Here you go! #491

[presidentbeef]

Fixed with #491