Mass Assignment (ARCH6129)

Key ruby.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Passing the whole request payload straight into a model lets attackers set protected attributes such as admin. Accept only allowlisted parameters.

Incorrect

class UsersController < ApplicationController
  def update
    @user.update(params[:user])
  end
end

Correct

class UsersController < ApplicationController
  def update
    @user.update(user_params)
  end

  private

  def user_params
    params.require(:user).permit(:name, :email)
  end
end

Fix

Explicitly allowlist permitted attributes using strong parameters (permit).