# @foo = Bar.new(params\[:foo\])

**URL:** <https://www.ruby-forum.com/t/foo-bar-new-params-foo/96622>\
**Category:** Rails\
**Created:** [June 30, 2006, 10:54am UTC](https://www.ruby-forum.com/t/foo-bar-new-params-foo/96622 "2006-06-30T10:54:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pratik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/4bbf92/32.png) [@pratik](https://www.ruby-forum.com/u/pratik)\
**Post date:** [June 30, 2006, 10:54am UTC](https://www.ruby-forum.com/t/foo-bar-new-params-foo/96622/1 "2006-06-30T10:54:22Z")

</div>

While doing @foo = Bar.new(params[:foo]) in a controller, the  
application is open to injection attacks.

For example,  
My model has following attributes :  
name  
password  
admin - boolean

Now, if on my form I’m just acception name & password, and doing @foo  
= Bar.new(params[:foo]) in my controller, someone can just enter  
following in form :

\<%= text\_field ‘foo’, ‘admin’ %\> and set to it to true, and post it to  
my controller.

Right now, for such attributes, I’m doing the following :  
@foo = Bar.new(params[:foo])  
@foo.admin = false

But I’m sure there are better conventions to overcome this problem.  
Please let me know how do you handle this problem ?

Regards,  
Pratik

---

<div class="post-metadata">

**Author:** ![pratik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/4bbf92/32.png) [@pratik](https://www.ruby-forum.com/u/pratik)\
**Post date:** [June 30, 2006, 12:30pm UTC](https://www.ruby-forum.com/t/foo-bar-new-params-foo/96622/2 "2006-06-30T12:30:10Z")

</div>

> While doing @foo = Bar.new(params[:foo]) in a controller, the  
> application is open to injection attacks.  
> I wouldn’t say this ‘injection’ in the traditional sense of the term.  
> This is more about application design. As the admin switch is really  
> important, protect it in the model:

attr\_protected :admin

Then provide methods to grant and revoke admin status:

def grant\_admin  
admin = 1  
end

def revoke\_admin  
admin = 0  
end

Hope that helps,

Steve

---

<div class="post-metadata">

**Author:** ![pratik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/4bbf92/32.png) [@pratik](https://www.ruby-forum.com/u/pratik)\
**Post date:** [August 3, 2006, 11:57am UTC](https://www.ruby-forum.com/t/foo-bar-new-params-foo/96622/3 "2006-08-03T11:57:36Z")

</div>

attr\_protected

> **[ActiveRecord::Base](https://api.rubyonrails.org/classes/ActiveRecord/Base.html#M000873)**
>
> Active Record Active Record objects don't specify their attributes directly, but rather infer them from the table definition with which they're linked.

-Jonathan.

---

<div class="post-metadata">

**Author:** ![pratik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/4bbf92/32.png) [@pratik](https://www.ruby-forum.com/u/pratik)\
**Post date:** [August 3, 2006, 2:24pm UTC](https://www.ruby-forum.com/t/foo-bar-new-params-foo/96622/4 "2006-08-03T14:24:09Z")

</div>

Awesome.

Thanks a lot.

-Pratik