CODEWITHSUNDEEP
ruby-on-railsrubyformssecurity
Dmitry
Dmitry

Reputation: 7553

Rails: protect from extra fields in model (mass assignment)?

I have a model Secret with 3 fields: f1, f2 and f3.
I have a form where user can input only f1 and f2. Not f3.
What is the best way to pass values to new object?

If I will write @secret = Secret.new(params[:secret]), evil user may pass f3 to my model, and it will be saved in model.

What is the best way to prevent users from passing extra values?

I read http://guides.rubyonrails.org/security.html#mass-assignment and there are 3 variants:
1) Blacklist (attr_protected :f3)
2) Whitelist (attr_accessible :f1, :f2)
3) Global whitelist (force attr_accessible by configuration line config.active_record.whitelist_attributes = true)

What method is the best?

Upvotes: 1

Views: 86

Answers (1)

iblue
iblue

Reputation: 30434

The most paranoid (and thus the best) setting would be attr_accessible :f1, :f2 combined with config.active_record.whitelist_attributes = true.

If you add any new attributes later (by adding migrations), you will have to activly enable the new attributes for mass asignment. If you just blacklist the forbidden ones, you might forget to add new attributes to your blacklist. This will not happen, if you use a whitelist.

Upvotes: 2

Related Questions