I just threw together a quick gem that will ensure active_record model attributes are protected from mass-assignment unless explicitly declared as mass-assignable.
Granted, this as default will break an app that does not have the correct attributes declared as mass-assignable, but the alternative is a vulnerable app.
Comments
I just threw together a quick gem that will ensure active_record model attributes are protected from mass-assignment unless explicitly declared as mass-assignable.
Granted, this as default will break an app that does not have the correct attributes declared as mass-assignable, but the alternative is a vulnerable app.
https://github.com/stevegraham/default_whitelist
This feature already exists in Rails.
https://github.com/lest/rails/commit/f2fa4837a8a888ee86997be...
Only for relatively new versions of Rails. The oldest version of Rails including this patch was released January 20, 2012.
Note that that commit is only a comment -- the addition of "whitelist_attributes" presumably is older.
It was added in Rails 3.1.