Sha256: 50fe6782e816c30959fdd855e38bb2d58c8d4b31dd2b282de73bd1bb519ee343
Contents?: true
Size: 1.17 KB
Versions: 4
Compression:
Stored size: 1.17 KB
Contents
require 'simplabs/excellent/checks/base'
module Simplabs
module Excellent
module Checks
module Rails
# This check reports +ActiveRecord+ models that do not specify +attr_accessible+. Specifying +attr_accessible+ is viable to protect models from
# mass assignment attacks (see http://guides.rubyonrails.org/security.html#mass-assignment). +attr_accessible+ specifies a list of properties
# that are writeable by mass assignments. For a +User+ model for example, that list would possibly include properties like +first_name+ and
# +last_name+ while it should not include properties like +is_admin+.
#
# ==== Applies to
#
# * +ActiveRecord+ models
class AttrAccessibleCheck < Base
def initialize(options = {}) #:nodoc:
super
@interesting_contexts = [Parsing::ClassContext]
end
def evaluate(context) #:nodoc:
add_warning(context, '{{class}} does not specify attr_accessible.', { :class => context.full_name }) if context.active_record_model? && !context.specifies_attr_accessible?
end
end
end
end
end
end
Version data entries
4 entries across 4 versions & 1 rubygems