# Model.new(params) can be dangerous?

**URL:** <https://www.ruby-forum.com/t/model-new-params-can-be-dangerous/142748>\
**Category:** Rails\
**Created:** [July 11, 2008, 1:49am UTC](https://www.ruby-forum.com/t/model-new-params-can-be-dangerous/142748 "2008-07-11T01:49:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mjacobs](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mjacobs](https://www.ruby-forum.com/u/mjacobs)\
**Post date:** [July 11, 2008, 1:49am UTC](https://www.ruby-forum.com/t/model-new-params-can-be-dangerous/142748/1 "2008-07-11T01:49:18Z")

</div>

I was just thinking,  
what if someone accidentally leaves something dangerous in a blah=  
method…

could have some really bad consequences.

Perhaps we’re better off defining all write-able attributes,  
rather than doing an “attr\_protected” on all the ones we dont want.

> **[Whoops! Rails security flaw.](http://rudyonrails.blogspot.com/2008/07/whoops-rails-security-flaw.html)**
>
> Yeah, I accidentally messed up my whole website. All because I did a bit of stupid HTML. ... \<%= text\_field :post, :name %\> ... And the cont...

another reason I’m swaying toward Datamapper over ActiveRecord.

---

<div class="post-metadata">

**Author:** ![mjacobs](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mjacobs](https://www.ruby-forum.com/u/mjacobs)\
**Post date:** [July 11, 2008, 11:39am UTC](https://www.ruby-forum.com/t/model-new-params-can-be-dangerous/142748/2 "2008-07-11T11:39:29Z")

</div>

Matthew R. Jacobs wrote:

> I was just thinking,  
> what if someone accidentally leaves something dangerous in a blah=  
> method…
> 
> could have some really bad consequences.
> 
> Perhaps we’re better off defining all write-able attributes,  
> rather than doing an “attr\_protected” on all the ones we dont want.
> 
> [MatthewRudyOnRails: Whoops! Rails security flaw.](http://rudyonrails.blogspot.com/2008/07/whoops-rails-security-flaw.html)
> 
> another reason I’m swaying toward Datamapper over ActiveRecord.  
> whoops…  
> Rails already allows this;

“”"  
attr\_accessible(\*attributes)

Specifies a white list of model attributes that can be set via  
mass-assignment, such as new(attributes), update\_attributes(attributes),  
or attributes=(attributes)

This is the opposite of the attr\_protected macro: Mass-assignment will  
only set attributes in this list, to assign to the rest of attributes  
you can use direct writer methods. This is meant to protect sensitive  
attributes from being overwritten by malicious users tampering with URLs  
or forms. If you‘d rather start from an all-open default and restrict  
attributes as needed, have a look at attr\_protected.

class Customer \< ActiveRecord::Base  
attr\_accessible :name, :nickname  
end

customer = Customer.new(:name =\> “David”, :nickname =\> “Dave”,  
:credit\_rating =\> “Excellent”)  
customer.credit\_rating # =\> nil  
customer.attributes = { :name =\> “Jolly fellow”, :credit\_rating =\>  
“Superb” }  
customer.credit\_rating # =\> nil

customer.credit\_rating = “Average”  
customer.credit\_rating # =\> “Average”  
“”"