Sha256: b16f060f570b2b7f3a56b360e78c652085e5c4572b84aa711dcfe3d2d7874e78
Contents?: true
Size: 1.23 KB
Versions: 4
Compression:
Stored size: 1.23 KB
Contents
require 'simplabs/excellent/checks/base'
module Simplabs
module Excellent
module Checks
module Rails
# This check reports +ActiveRecord+ models that specify +attr_protected+. Like +attr_accessible+, +attr_protected+ is a helper to secure
# +ActiveRecord+ models against mass assignment attacks (see http://guides.rubyonrails.org/security.html#mass-assignment), but instead of
# specifying a white list of properties that are writeable by mass assignments as +attr_accessible+ does, +attr_protected+ specifies a black
# list. Such a black list approach is usually less secure since the list has to be updated for every new property that is introduced, which
# is easy to forget.
#
# ==== Applies to
#
# * +ActiveRecord+ models
class AttrProtectedCheck < Base
def initialize #:nodoc:
super
@interesting_contexts = [Parsing::ClassContext]
end
def evaluate(context) #:nodoc:
add_warning(context, '{{class}} specifies attr_protected.', { :class => context.full_name }) if context.active_record_model? && context.specifies_attr_protected?
end
end
end
end
end
end
Version data entries
4 entries across 4 versions & 1 rubygems