presidentbeef/brakeman — Issue #31: attr_accessible false positive
Author: justinwiley
Created: 2012-01-17 20:03:38+00:00
State: open

Noticed attr_accessible warning seems to be triggered even when attr is protected (assuming I'm correctly interpreting attr_accessible). Rails 3.1.3

No attr accessible

class Affiliation < ActiveRecord::Base
belongs_to :user
belongs_to :group
end

Affiliation vulnerable

ruby-1.9.3-p0 :009 > Affiliation.create! :group => Group.first, :user => User.first
Group Load (0.3ms) SELECT `groups`.* FROM `groups` LIMIT 1
User Load (1.4ms) SELECT `users`.* FROM `users` LIMIT 1
(0.2ms) BEGIN
SQL (0.4ms) INSERT INTO `affiliations` (`created_at`, `group_id`, `user_id`, `updated_at`) VALUES ('2012-01-17 19:47:15', 2, 77, '2012-01-17 19:47:15')
(1.6ms) COMMIT
=> #

Adding attr_accessible without arguments:

class Affiliation < ActiveRecord::Base
attr_accessible

belongs_to :user
belongs_to :group
end

Protected against mass-assignment

ruby-1.9.3-p0 :011 > Affiliation.create! :group => Group.first, :user => User.first
Group Load (0.3ms) SELECT `groups`.* FROM `groups` LIMIT 1
User Load (0.3ms) SELECT `users`.* FROM `users` LIMIT 1
WARNING: Can't mass-assign protected attributes: group, user

Brakeman still shows:

Model Warnings:

+----------------------------------------------------------------------------->>
| Confidence | >>
+----------------------------------------------------------------------------->>
| High | Affiliation >>
+----------------------------------------------------------------------------->>