Mass Assignment Vulnerability -- Another Suggestion

John Trupiano
2009-03-01T19:39:51Z

Hey guys,

Several of you chimed in on the blog post I wrote last week discussing
mass assignment vulnerabilities (and how nested mass assignment
created further exposure).  Thanks for pitching in a hand on the
discussion.  I''ve submitted a patch to docrails to beef up the mass
assignment section of the security document to include some more
details and countermeasures.

One countermeasure strikes me as particularly interesting.  Littered
throughout the security doc are references to the concept that
whitelisting is a good security practice.  So, what if we made the
decision to force users to whitelist their model attributes (via
attr_accessible)?  This can be achieved in a current rails app with a
simple initializer containing a single line:

ActiveRecord::Base.send(:attr_accessible, nil)

What if we made this the default behavior?  In other words, in order
to allow mass assignment at all, developers would be required to
explicitly include this in their model.  The generators could be
updated to include the attr_accessible declaration in auto-generated
code.  Even if the generators whitelisted all parameters by default,
it would still serve the community to see the attr_accessible line in
every single model.

With 2.3 being so close, I''d think we''d want to consider a
change like
this for 3.0.  What do you guys think?

-John