jnunemaker/mongomapper — Issue #342: attr_accessible not applied to attributes= (SECURITY ISSUE)
Author: balexand
Created: 2011-11-06 19:20:18+00:00
State: open

Inaccessible attributes are being properly filtered through the constructor and `update_attributes`, but not through the `attributes=` method. It looks like the [attributes=](https://github.com/jnunemaker/mongomapper/blob/v0.10.0/lib/mongo_mapper/plugins/keys.rb#L175) assigns without filtering inaccessible attributes. This behavior is inconsistent with ActiveRecord and could pose a security threat if developers assume that inaccessible attributes are being filtered. The workaround is to use `assign` instead of `attributes=`.

class Foo
include MongoMapper::Document
attr_accessible :name

key :name, String
key :special, String
end

describe Foo do
# pass
it "should not mass assign special in constructor" do
Foo.new(:special => "value").special.should_not == "value"
end

# FAIL!
it "should not mass assign special in attributes=" do
foo = Foo.new
foo.attributes = {:special => "value"}
foo.special.should_not == "value"
end

# pass
it "should not mass assign special in assign" do
foo = Foo.new
foo.assign(:special => "value")
foo.special.should_not == "value"
end

# pass
it "should not mass assign special in update_attributes" do
foo = Foo.create!
foo.update_attributes(:special => "value")
foo.special.should_not == "value"
end
end