3 ms·

For reference, it's easy to determine if a Rails application is vulnerable to mass assignment attacks by attempting to set an attribute that is unlikely to exis

For reference, it's easy to determine if a Rails application is vulnerable to mass assignment attacks by attempting to set an attribute that is unlikely to exist (e.g., user[asdfg]). In the majority of cases a 500 error will be returned if the application is vulnerable.

nirvdrum 15y ago
Sorta. You can blacklist instead of whitelist. The blacklist could make you secure, while still resulting is this 500.