class RailsBestPractices::Reviews::ProtectMassAssignmentReview

Review model files to make sure to use attr_accessible, attr_protected or strong_parameters to protect mass assignment.

See the best practices details here rails-bestpractices.com/posts/2012/03/06/protect-mass-assignment/

Implmentation:

Review process:

check nodes to see if there is a command with message attr_accessible or attr_protected,
or include ActiveModel::ForbiddenAttributesProtection.

Private Instance Methods

check_active_record(const_path_ref_node) click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 102
def check_active_record(const_path_ref_node)
  if const_path_ref_node.base_class.to_s != 'ActiveRecord::Base'
    @mass_assignement = false
  end
end
check_activerecord_version() click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 58
def check_activerecord_version
  if Prepares.gems.gem_version('activerecord').to_i > 3
    @mass_assignement = false
  end
end
check_authlogic(node) click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 96
def check_authlogic(node)
  if [node.to_s, node.message.to_s].include? 'acts_as_authentic'
    @mass_assignement = false
  end
end
check_devise(command_node) click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 90
def check_devise(command_node)
  if command_node.message.to_s == 'devise'
    @mass_assignement = false
  end
end
check_include_forbidden_attributes_protection_config() click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 70
def check_include_forbidden_attributes_protection_config
  if Prepares.configs['railsbp.include_forbidden_attributes_protection'] == 'true'
    @mass_assignement = false
  end
end
check_rails_builtin(node) click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 76
def check_rails_builtin(node)
  if @whitelist_attributes ||
       [node.to_s, node.message.to_s].any? { |str| %w[attr_accessible attr_protected].include? str }
    @mass_assignement = false
  end
end
check_strong_parameters(command_node) click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 83
def check_strong_parameters(command_node)
  if command_node.message.to_s == 'include' &&
       command_node.arguments.all.first.to_s == 'ActiveModel::ForbiddenAttributesProtection'
    @mass_assignement = false
  end
end
check_whitelist_attributes_config() click to toggle source
# File lib/rails_best_practices/reviews/protect_mass_assignment_review.rb, line 64
def check_whitelist_attributes_config
  if Prepares.configs['config.active_record.whitelist_attributes'] == 'true'
    @whitelist_attributes = true
  end
end