Contents

require 'railroader/checks/base_check'

class Railroader::CheckPermitAttributes < Railroader::BaseCheck
  Railroader::Checks.add self

  @description = "Warn on potentially dangerous attributes whitelisted via permit"

  SUSPICIOUS_KEYS = {
    admin: :high,
    account_id: :high,
    role: :medium,
    banned: :medium,
  }

  def run_check
    tracker.find_call(:method => :permit).each do |result|
      check_permit result
    end
  end

  def check_permit result
    return unless original? result

    call = result[:call]

    call.each_arg do |arg|
      if symbol? arg
        if SUSPICIOUS_KEYS.key? arg.value
          warn_on_permit_key result, arg
        end
      end
    end
  end

  def warn_on_permit_key result, key, confidence = nil
    warn :result => result,
      :warning_type => "Mass Assignment",
      :warning_code => :dangerous_permit_key,
      :message => "Potentially dangerous key allowed for mass assignment",
      :confidence => (confidence || SUSPICIOUS_KEYS[key.value]),
      :user_input => key
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
railroader-4.3.8	lib/railroader/checks/check_permit_attributes.rb
railroader-4.3.7	lib/railroader/checks/check_permit_attributes.rb
railroader-4.3.5	lib/railroader/checks/check_permit_attributes.rb
railroader-4.3.4	lib/railroader/checks/check_permit_attributes.rb