3 ms·
I just threw together a quick gem that will ensure active_record model attributes are protected from mass-assignment unless explicitly declared as mass-assignab
by sjtgraham 15y ago
I just threw together a quick gem that will ensure active_record model attributes are protected from mass-assignment unless explicitly declared as mass-assignable.
Granted, this as default will break an app that does not have the correct attributes declared as mass-assignable, but the alternative is a vulnerable app.
https://github.com/stevegraham/default_whitelist https://github.com/stevegraham/default_whitelist
- wtn 15y agoThis feature already exists in Rails. https://github.com/lest/rails/commit/f2fa4837a8a888ee86997be892d0aa5bbd2b5fd0 https://github.com/lest/rails/commit/f2fa4837a8a888ee86997be...