# Rails security issue

**URL:** <https://discuss.rubyonrails.org/t/rails-security-issue/29895>\
**Category:** rubyonrails-talk\
**Created:** [May 28, 2008, 5:22am UTC](https://discuss.rubyonrails.org/t/rails-security-issue/29895 "2008-05-28T05:22:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![11175](https://avatars.discourse-cdn.com/v4/letter/1/8edcca/32.png) [@11175](https://discuss.rubyonrails.org/u/11175)\
**Post date:** [May 28, 2008, 5:22am UTC](https://discuss.rubyonrails.org/t/rails-security-issue/29895/1 "2008-05-28T05:22:51Z")

</div>

I know this is not a REAL security issue, but I think it could be and this seems very "unrails" like. What's to keep a user from modifying the post hash they send to the server to set ANY attributes they want for an AR object? attr\_protected? So I have to write an attr\_protected line in my model for EVERY relationship I set up? This seems bad:

1. It's redundant and not what I would expect in rails. 2. If I forget to attr\_protect a foreign key attribute I all of a sudden have a possible security issue.

Let's pretend a User belongs to a user group, has and belongs to many roles, and has many orders. So I need to do the following to make my model secure?

attr\_protected :user\_group\_id, :role\_ids, :order\_ids

Am I missing something or am I the only person that thinks something is wrong with this?

---

<div class="post-metadata">

**Author:** ![clouder](https://avatars.discourse-cdn.com/v4/letter/c/0ea827/32.png) [@clouder](https://discuss.rubyonrails.org/u/clouder)\
**Post date:** [May 28, 2008, 5:36am UTC](https://discuss.rubyonrails.org/t/rails-security-issue/29895/2 "2008-05-28T05:36:05Z")

</div>

attr\_accessible is what I think you want I found out about it at [#26 Hackers Love Mass Assignment - RailsCasts](http://railscasts.com/episodes/26)

---

<div class="post-metadata">

**Author:** ![Adam3](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Adam3](https://discuss.rubyonrails.org/u/Adam3)\
**Post date:** [May 28, 2008, 2:49pm UTC](https://discuss.rubyonrails.org/t/rails-security-issue/29895/3 "2008-05-28T14:49:16Z")

</div>

Hey Ben, and remember that if you use the 'attr\_accessible' macro, that all attributes \*not\* defined will be protected.

Adam

---

<div class="post-metadata">

**Author:** ![Greg\_Willits](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@Greg\_Willits](https://discuss.rubyonrails.org/u/Greg_Willits)\
**Post date:** [May 29, 2008, 8:58am UTC](https://discuss.rubyonrails.org/t/rails-security-issue/29895/4 "2008-05-29T08:58:37Z")

</div>

attr\_accessible is only a partial solution for a narrow field of cases. Allowed fields in a POST or GET need to be defined on a case by case, for by form basis -- \_not\_ on a model-wide basis.

Allowing field x to be submitted in form A may be ok, but allowing it to be submitted in form B may not.

In my own frameworks I have always had a server-side definition in the processing of every specific form of which fields were allowed. That was one of the very first things I found myself writing a little method for in Rails. I have a library of misc Security Utility methods. This is one of them:

def SecurityUtilities.distill\_params(allowed\_inputs, input\_params) &nbsp;&nbsp;&nbsp;input\_params.delete\_if do |input\_name, input\_value| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;!(allowed\_inputs.include?(input\_name.to\_sym)) &nbsp;&nbsp;&nbsp;end end

Prior to any form process, I first weed out the garbage from params by defining the allowed\_inputs:

allowed\_inputs = [&nbsp;&nbsp;&nbsp;:userType, :pswd1, :pswd2, &nbsp;&nbsp;&nbsp;:userFirstName, :userLastName, &nbsp;&nbsp;&nbsp;:userEmail, :userHint, :userHosts]

which gets passed along with the params to filter unwnted k-v pairs from params.