# Form Data Injection - How to protect against? **URL:** \ **Category:** Rails\ **Created:** [October 3, 2006, 6:16pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887 "2006-10-03T18:16:07Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Dylan\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bc8723/32.png) [@Dylan\_B](https://www.ruby-forum.com/u/Dylan_B)\ **Post date:** [October 3, 2006, 6:16pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887/1 "2006-10-03T18:16:07Z")
I might be missing something here, but it seems as if the conventions used when building forms in Rails apps leave a lot of open holes for people to mess things up. For instance, let’s say I have a multi-user community app with a simple user profile page where users can edit their profile. Not uncommon. Now, on that page they can change things like their name, web site, IM info, etc. But with what seems to be standard practice of updating that info, as so… def update @user = User.find(params[:id]) if @user.update\_attributes(params[:user]) etc., etc. …it seems like you are open for major problems. Let’s say you have a role field on your model. It seems trivial to have someone inject their own form data into the headers to add the equivalent of… …and have that be passed along with the .update\_attributes method. Am I wrong? Is there some common practice of protecting against this that I am just missing? And if this isn’t common practice, it should be, shouldn’t it? There is the obvious blunt route of being super-careful and checking every field of the model, regardless of whether it’s on the form or not, but I don’t see that being practiced, so I thought maybe I’m missing something. ---
**Author:** ![Dylan\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bc8723/32.png) [@Dylan\_B](https://www.ruby-forum.com/u/Dylan_B)\ **Post date:** [October 3, 2006, 6:24pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887/2 "2006-10-03T18:24:09Z")
On Oct 3, 2006, at 9:11 AM, Dylan B. wrote: > I might be missing something here, but it seems as if the conventions > used when building forms in Rails apps leave a lot of open holes for > people to mess things up. You missed attr\_accessible and it’s partner attr\_protected in the models. 🙂 – – Tom M. ---
**Author:** ![Dylan\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bc8723/32.png) [@Dylan\_B](https://www.ruby-forum.com/u/Dylan_B)\ **Post date:** [October 3, 2006, 6:32pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887/3 "2006-10-03T18:32:17Z")
You are very right. I did. I just finished reading up about them. And following other discussions on this topic. Like [http://www.ruby-forum.com/topic/54867](http://www.ruby-forum.com/topic/54867) I pointed the people in #rubyonrails on freenode to this post and got a quick answer from stympy about checking out attr\_protected and attr\_accessible. Knowing that was the answer, I was able to find quite a lot of data. I simply had the wrong search terms for getting my question answered. 🙂 ---
**Author:** ![Dylan\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bc8723/32.png) [@Dylan\_B](https://www.ruby-forum.com/u/Dylan_B)\ **Post date:** [October 3, 2006, 7:04pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887/4 "2006-10-03T19:04:22Z")
On Oct 3, 2006, at 18:11, Dylan B. wrote: > …and have that be passed along with the .update\_attributes > method. Am > I wrong? > > Is there some common practice of protecting against this that I am > just > missing? You are correct, and you are missing attr\_protected and attr\_accessible. – Jakob S. - [http://mentalized.net](http://mentalized.net) ---
**Author:** ![Dylan\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bc8723/32.png) [@Dylan\_B](https://www.ruby-forum.com/u/Dylan_B)\ **Post date:** [October 3, 2006, 7:00pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887/5 "2006-10-03T19:00:21Z")
Here’s what you need… [http://manuals.rubyonrails.com/read/chapter/47](http://manuals.rubyonrails.com/read/chapter/47) ---
**Author:** ![Dylan\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bc8723/32.png) [@Dylan\_B](https://www.ruby-forum.com/u/Dylan_B)\ **Post date:** [October 4, 2006, 5:28pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887/6 "2006-10-04T17:28:43Z")
Another thing you need to keep in mind is about ‘access rights’ to the record, not just to fields within the record. I, as user\_id = 10 can go to /users/10;edit, but I cannot go to /users/1;edit. In my user controller I have this: # I already declare basic authentication in my application.rb before\_filter :verify\_user, :except =\> [ :check\_field, :create, :new, :retrieve\_password ] protected def verify\_user return true if params[:id].nil? || params[:id].to\_i == session[:user] flash[:error] = “You are not allowed to see another users Settings screen.” redirect\_to\_default false end and that works like a charm Adam ---
**Author:** ![Dylan\_B](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bc8723/32.png) [@Dylan\_B](https://www.ruby-forum.com/u/Dylan_B)\ **Post date:** [October 3, 2006, 8:06pm UTC](https://www.ruby-forum.com/t/form-data-injection-how-to-protect-against/70887/7 "2006-10-03T20:06:48Z")
Jakob S. wrote: > On Oct 3, 2006, at 18:11, Dylan B. wrote: > > > …and have that be passed along with the .update\_attributes > > method. Am > > I wrong? > > > > Is there some common practice of protecting against this that I am > > just > > missing? > > You are correct, and you are missing attr\_protected and attr\_accessible. IMO this kind of access control is a job for the controller, not for the model.