Mass Assignment Testing
Understand how mass assignment poses security risks in Rails applications and learn to write tests that verify proper use of strong parameters. Explore techniques to prevent unauthorized attribute updates by testing controller methods and workflows.
Mass assignment testing
Mass assignment is a common Rails security issue, caused by Rails’s ability to save an arbitrary hash of attribute names and values to an instance by sending an entire hash as a parameter, as in new(params[:user]), create(params[:user]), or update_attributes(params[:user]). The security issue happens when somebody hacks a request and adds unexpected attributes to the incoming parameters, typically an attribute that we wouldn’t want an arbitrary user to change, such as User#admin or Project#public. (GitHub was famously hacked via this ...