# Rails security issue

**URL:** <https://www.ruby-forum.com/t/rails-security-issue/138837>\
**Category:** Rails\
**Created:** [May 28, 2008, 7:22am UTC](https://www.ruby-forum.com/t/rails-security-issue/138837 "2008-05-28T07:22:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [May 28, 2008, 7:22am UTC](https://www.ruby-forum.com/t/rails-security-issue/138837/1 "2008-05-28T07:22:51Z")

</div>

I know this is not a REAL security issue, but I think it could be and  
this seems very “unrails” like. What’s to keep a user from modifying the  
post hash they send to the server to set ANY attributes they want for an  
AR object? attr\_protected? So I have to write an attr\_protected line in  
my model for EVERY relationship I set up? This seems bad:

1. It’s redundant and not what I would expect in rails.
2. If I forget to attr\_protect a foreign key attribute I all of a sudden  
have a possible security issue.

Let’s pretend a User belongs to a user group, has and belongs to many  
roles, and has many orders. So I need to do the following to make my  
model secure?

attr\_protected :user\_group\_id, :role\_ids, :order\_ids

Am I missing something or am I the only person that thinks something is  
wrong with this?

---

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [May 28, 2008, 7:36am UTC](https://www.ruby-forum.com/t/rails-security-issue/138837/2 "2008-05-28T07:36:57Z")

</div>

attr\_accessible is what I think you want  
I found out about it at [#26 Hackers Love Mass Assignment - RailsCasts](http://railscasts.com/episodes/26)

---

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [May 28, 2008, 4:49pm UTC](https://www.ruby-forum.com/t/rails-security-issue/138837/3 "2008-05-28T16:49:56Z")

</div>

Hey Ben,  
and remember that if you use the ‘attr\_accessible’ macro, that all  
attributes _not_ defined will be protected.

## Adam

SweetSpot.dm – Diabetes Wellness for the Family  
[http://www.SweetSpot.dm](http://www.SweetSpot.dm)  
[http://blog.SweetSpot.dm](http://blog.SweetSpot.dm)

---

<div class="post-metadata">

**Author:** ![benjohnson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3ec8ea/32.png) [@benjohnson](https://www.ruby-forum.com/u/benjohnson)\
**Post date:** [May 29, 2008, 10:59am UTC](https://www.ruby-forum.com/t/rails-security-issue/138837/4 "2008-05-29T10:59:01Z")

</div>

On May 27, 2008, at 10:36 PM, clouder wrote:

> attr\_accessible is what I think you want  
> I found out about it at [#26 Hackers Love Mass Assignment - RailsCasts](http://railscasts.com/episodes/26)

attr\_accessible is only a partial solution for a narrow field of  
cases. Allowed fields in a POST or GET need to be defined on a case  
by case, for by form basis – _not_ on a model-wide basis.

Allowing field x to be submitted in form A may be ok, but allowing it  
to be submitted in form B may not.

In my own frameworks I have always had a server-side definition in  
the processing of every specific form of which fields were allowed.  
That was one of the very first things I found myself writing a little  
method for in Rails. I have a library of misc Security Utility  
methods. This is one of them:

def SecurityUtilities.distill\_params(allowed\_inputs, input\_params)  
input\_params.delete\_if do |input\_name, input\_value|  
!(allowed\_inputs.include?(input\_name.to\_sym))  
end  
end

Prior to any form process, I first weed out the garbage from params  
by defining the allowed\_inputs:

allowed\_inputs = [  
:userType, :pswd1, :pswd2,  
:userFirstName, :userLastName,  
:userEmail, :userHint, :userHosts]

which gets passed along with the params to filter unwnted k-v pairs  
from params.

–  
def gw  
writes\_at ‘www.railsdev.ws’  
end