Class Brakeman::CheckMassAssignment
In: lib/brakeman/checks/check_mass_assignment.rb
Parent: Brakeman::BaseCheck

Checks for mass assignments to models.

See guides.rubyonrails.org/security.html#mass-assignment for details

Methods

all_literal_args?   check_call   check_mass_assignment   check_permit!   find_mass_assign_calls   literal?   new   process_result   run_check   subsequent_mass_assignment?   warn_on_permit!  

Constants

LITERALS = Set[:lit, :true, :false, :nil, :string]

Public Class methods

Public Instance methods

check_call(call)

Want to ignore calls to Model.new that have no arguments

check_permit!()

Look for and warn about uses of Parameters#permit! for mass assignment

process_result(res)

All results should be Model.new(...) or Model.attributes=() calls

subsequent_mass_assignment?(result)

Look for actual use of params in mass assignment to avoid warning about uses of Parameters#permit! without any mass assignment or when mass assignment is restricted by model instead.

[Validate]