2 ms·
When using the shale gem, how would you avoid the mass assignment problem? Is there a configuration, or a way of using the shale gem to avoid it? CWE-915: Impr
by alipitch 4y ago
When using the shale gem, how would you avoid the mass assignment problem? Is there a configuration, or a way of using the shale gem to avoid it?
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes <https://cwe.mitre.org/data/definitions/915.html https://cwe.mitre.org/data/definitions/915.html> (Ruby on Rails Mass assignment bug)
- DANK_YACHT 4y agoThis seems like programmer error. Don't put restricted fields into types you're deserializing off the wire. It's like accepting user input and directly inserting it into a database without any validation.
- beerkg 4y agoIf you don't define attributes explicitly on the model, Shale will ignore them. Regarding attributes that you defined but still don't want to be assigned, you should probably filter them before passing them to Shale, or alternatively filter them with Shale before passing them further down the stack (e.g to ActiveRecord)