Rails: protect from extra fields in model (mass assignment)?

Question

I have a model Secret with 3 fields: f1, f2 and f3.
I have a form where user can input only f1 and f2. Not f3.
What is the best way to pass values to new object?

If I will write @secret = Secret.new(params[:secret]), evil user may pass f3 to my model, and it will be saved in model.

What is the best way to prevent users from passing extra values?

I read http://guides.rubyonrails.org/security.html#mass-assignment and there are 3 variants:
1) Blacklist (attr_protected :f3)
2) Whitelist (attr_accessible :f1, :f2)
3) Global whitelist (force attr_accessible by configuration line config.active_record.whitelist_attributes = true)

What method is the best?

iblue · Accepted Answer · 2012-08-09 22:47:06Z

2

The most paranoid (and thus the best) setting would be attr_accessible :f1, :f2 combined with config.active_record.whitelist_attributes = true.

If you add any new attributes later (by adding migrations), you will have to activly enable the new attributes for mass asignment. If you just blacklist the forbidden ones, you might forget to add new attributes to your blacklist. This will not happen, if you use a whitelist.

answered Aug 9, 2012 at 22:47

iblue

30.6k20 gold badges93 silver badges130 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Rails: protect from extra fields in model (mass assignment)?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related