presidentbeef/brakeman — Issue #44: warn for mass assignment when using Model.proxy.build(params[:object])
Author: oreoshake
Created: 2012-02-08 22:56:01+00:00
State: open

I'm pretty sure the code:

a = current_user.foo
a.bars.build(params[:bar])

Is vulnerable to mass assignment without attr_protected/accessible.

ActiveRecord::Associations::AssociationCollection#build calls

@reflection.build_association(attrs)

which calls

klass.new(*options)

which calls init, which calls

attributes=

I think brakeman should warn if build is used without attr_ restriction