# Cattr\_accessor and ActiveRecord attribute mass assignment **URL:** \ **Category:** Rails\ **Created:** [January 25, 2007, 2:24pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351 "2007-01-25T14:24:55Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 25, 2007, 2:24pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/1 "2007-01-25T14:24:55Z")
Looks like cattr\_accessors, defined for ActiveRecord::Base can be set through mass assignment of attributes for new model instances. Following example uses table “model (id serial, name text)”, and with script/console : > > class Model \< ActiveRecord::Base; end > > =\> nil > > > ActiveRecord::Base.allow\_concurrency > > =\> false > > > m = Model.new(‘allow\_concurrency’ =\> ‘true’, ‘colorize\_logging’ =\> > > ‘oh yes!’, ‘name’ =\> ‘try001’) > > =\> #\“try001”}, @new\_record=true\> > > > ActiveRecord::Base.allow\_concurrency > > =\> “true” I wonder, if this is a bug, or just hidden feature of “cattr\_accessor”? ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 25, 2007, 2:46pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/2 "2007-01-25T14:46:59Z")
On 1/25/07, Lugovoi N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > ‘oh yes!’, ‘name’ =\> ‘try001’) > =\> #\“try001”}, @new\_record=true\> > > > > ActiveRecord::Base.allow\_concurrency > > > =\> “true” > > I wonder, if this is a bug, or just hidden feature of “cattr\_accessor”? It’s a hidden feature of any writer method. Use attr\_protected or attr\_accessible to set which may be set through a mass assignment. [http://rails.rubyonrails.org/classes/ActiveRecord/Base.html#M001003](http://rails.rubyonrails.org/classes/ActiveRecord/Base.html#M001003) – Rick O. [http://weblog.techno-weenie.net](http://weblog.techno-weenie.net) [http://mephistoblog.com](http://mephistoblog.com) ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 25, 2007, 4:34pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/3 "2007-01-25T16:34:36Z")
2007/1/25, Rick O. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > It’s a hidden feature of any writer method. Use attr\_protected or > attr\_accessible to set which may be set through a mass assignment. Ok, it’s a hidden feature of all writer methods. But not adding fields, defined as “cattr\_accessor” in ActiveRecord::Base to attributes\_protected\_by\_default is, IMHO, ugly bug. As using Model.create(params[:model]) or build(params[:item]) isn’t (yet?) considered bad practice, and is, probably, quite widespread, one can just add, for example, “comment[verification\_timeout]=none” to post parameters and turn server to permanent error state, filling log with: ArgumentError (comparison of Fixnum with String failed): .//vendor/rails/activerecord/lib/active\_record/connection\_adapters/abstract\_adapter.rb:92:in `>' .//vendor/rails/activerecord/lib/active_record/connection_adapters/abstract_adapter.rb:92:in `verify!’ .//vendor/rails/activerecord/lib/active\_record/connection\_adapters/abstract/connection\_specification.rb:107:in `verify_active_connections!' .//vendor/rails/activerecord/lib/active_record/connection_adapters/abstract/connection_specification.rb:106:in `each\_value’ .//vendor/rails/activerecord/lib/active\_record/connection\_adapters/abstract/connection\_specification.rb:106:in `verify_active_connections!' .//vendor/rails/railties/lib/dispatcher.rb:111:in `prepare\_application’ [snip] Rendering script/…/config/…/public/500.html (500 Error) Shall we expect Rails 1.2.2 soon or just become paranoic and add attr\_accessible (with almost full list of columns) to all models meanwhile? 🙂 ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 25, 2007, 7:29pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/4 "2007-01-25T19:29:36Z")
On 1/25/07, Lugovoi N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > 2007/1/25, Rick O. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > > > It’s a hidden feature of any writer method. Use attr\_protected or > > attr\_accessible to set which may be set through a mass assignment. > > Ok, it’s a hidden feature of all writer methods. > But not adding fields, defined as “cattr\_accessor” in ActiveRecord::Base > to attributes\_protected\_by\_default is, IMHO, ugly bug. I agree, it’s a ugly bug and a likely security issue in most Rails apps. It would be better to have attributes\_accessable\_by\_default instead, defaulting to only the tables content\_columns (except primary key and magic columns). The Scaffolding Extensions plugin isn’t vulnerable to this because it only update attributes that are shown on the form. > ``` > .//vendor/rails/activerecord/lib/active_record/connection_adapters/abstract_adapter.rb:92:in > > ``` > > Shall we expect Rails 1.2.2 soon or just become paranoic and > add attr\_accessible (with almost full list of columns) to all models > meanwhile? 🙂 I certainly think this is deserving of a 1.2.2. Jeremy ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 26, 2007, 2:24am UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/5 "2007-01-26T02:24:47Z")
I have no patch, but I was about to write something to set attr\_accessible to a reasonable default to avoid explicitly writing long lists of attributes. I thought maybe I could share this code to collect ideas and opinions. So I turned it in a plugin. If someone is interested the download is at [http://rubyforge.org/frs/?group\_id=2585](http://rubyforge.org/frs/?group_id=2585) the file to download is activerecord\_auto\_accessible-0.0.1.tgz the actual code are 34 lines. any comment is really appreciated. Please note I haven’t yet properly tested it Paolo ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 25, 2007, 10:30pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/6 "2007-01-25T22:30:19Z")
> I certainly think this is deserving of a 1.2.2. PDI a patch. I add attr\_accessible to all my models anyway. I think that’s a good practice to get into. – Rick O. [http://weblog.techno-weenie.net](http://weblog.techno-weenie.net) [http://mephistoblog.com](http://mephistoblog.com) ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 26, 2007, 7:07pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/7 "2007-01-26T19:07:23Z")
On 1/25/07, Rick O. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > I certainly think this is deserving of a 1.2.2. > > PDI a patch. I add attr\_accessible to all my models anyway. I think > that’s a good practice to get into. Patch at [http://dev.rubyonrails.org/ticket/7401](http://dev.rubyonrails.org/ticket/7401). attr\_accessible is good practice, but secure by default is a better one. Jeremy ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [January 27, 2007, 2:16pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/8 "2007-01-27T14:16:39Z")
Hi – On Thu, 25 Jan 2007, Rick O. wrote: > > =\> false > > > > > > m = Model.new(‘allow\_concurrency’ =\> ‘true’, ‘colorize\_logging’ =\> > > > > ‘oh yes!’, ‘name’ =\> ‘try001’) > > > > =\> #\“try001”}, @new\_record=true\> > > > > ActiveRecord::Base.allow\_concurrency > > > > =\> “true” > > > > I wonder, if this is a bug, or just hidden feature of “cattr\_accessor”? > > It’s a hidden feature of any writer method. I’d have to agree that it’s a bug – at least, it’s contrary to the documentation: AR::Base.new: …valid attribute keys are determined by the column names of the associated table — hence you can‘t have attributes that aren‘t part of the table columns. and, in general, “attributes” and “all the attributes” and such phrases are used interchangeably in read and write contexts, without suggesting that they’re different. I know that attr\_accessible is available (and probably underutilized by me and others), but based on the documentation, it sounds like even the worst/loosest case should still not pull in the cattr values. (I know the discussion has progressed to patch-hood, etc. – I just now was catching up though 🙂 David – Q. What is THE Ruby book for Rails developers? A. RUBY FOR RAILS by David A. Black ([Ruby for Rails](http://www.manning.com/black)) (See what readers are saying! [http://www.rubypal.com/r4rrevs.pdf](http://www.rubypal.com/r4rrevs.pdf)) Q. Where can I get Ruby/Rails on-site training, consulting, coaching? A. Ruby Power and Light, LLC ([http://www.rubypal.com](http://www.rubypal.com)) ---
**Author:** ![Lugovoi\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/5fc32e/32.png) [@Lugovoi\_N](https://www.ruby-forum.com/u/Lugovoi_N)\ **Post date:** [February 1, 2007, 10:41pm UTC](https://www.ruby-forum.com/t/cattr-accessor-and-activerecord-attribute-mass-assignment/83351/9 "2007-02-01T22:41:18Z")
On 1/27/07, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > script/console : > > > I wonder, if this is a bug, or just hidden feature of “cattr\_accessor”? > > > and, in general, “attributes” and “all the attributes” and such > > > phrases are used interchangeably in read and write contexts, without > > > suggesting that they’re different. > > I know that attr\_accessible is available (and probably underutilized > by me and others), but based on the documentation, it sounds like even > the worst/loosest case should still not pull in the cattr values. > > (I know the discussion has progressed to patch-hood, etc. – I just > now was catching up though 🙂 This security issue was fixed in trunk with changesets 6050 and 6051. However, neither of these has yet been merged to stable. Is this an oversight, or was this intentional? If an oversight, can someone in core merge the changes to 1.2-stable so that this security issue will be fixed in 1.2.2? If intentional, can someone in core explain why? Thanks, Jeremy