class RailsBestPractices::Reviews::ProtectMassAssignmentReview
Review
model files to make sure to use attr_accessible, attr_protected or strong_parameters to protect mass assignment.
See the best practices details here rails-bestpractices.com/posts/2012/03/06/protect-mass-assignment/
Implmentation:
Review
process:
check nodes to see if there is a command with message attr_accessible or attr_protected, or include ActiveModel::ForbiddenAttributesProtection.
Private Instance Methods
check_active_record(const_path_ref_node)
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 102 def check_active_record(const_path_ref_node) if const_path_ref_node.base_class.to_s != 'ActiveRecord::Base' @mass_assignement = false end end
check_activerecord_version()
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 58 def check_activerecord_version if Prepares.gems.gem_version('activerecord').to_i > 3 @mass_assignement = false end end
check_authlogic(node)
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 96 def check_authlogic(node) if [node.to_s, node.message.to_s].include? 'acts_as_authentic' @mass_assignement = false end end
check_devise(command_node)
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 90 def check_devise(command_node) if command_node.message.to_s == 'devise' @mass_assignement = false end end
check_include_forbidden_attributes_protection_config()
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 70 def check_include_forbidden_attributes_protection_config if Prepares.configs['railsbp.include_forbidden_attributes_protection'] == 'true' @mass_assignement = false end end
check_rails_builtin(node)
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 76 def check_rails_builtin(node) if @whitelist_attributes || [node.to_s, node.message.to_s].any? { |str| %w[attr_accessible attr_protected].include? str } @mass_assignement = false end end
check_strong_parameters(command_node)
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 83 def check_strong_parameters(command_node) if command_node.message.to_s == 'include' && command_node.arguments.all.first.to_s == 'ActiveModel::ForbiddenAttributesProtection' @mass_assignement = false end end
check_whitelist_attributes_config()
click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 64 def check_whitelist_attributes_config if Prepares.configs['config.active_record.whitelist_attributes'] == 'true' @whitelist_attributes = true end end