Home/ Questions/Q 9215873
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-18T02:17:57+00:00

I am going through Hartl’s Rails Tutorial. I’m up to the first exercise of

  • 0

I am going through Hartl’s Rails Tutorial. I’m up to the first exercise of 9.6, where he asks me to test that the User admin attribute isn’t accessible. The justification is earlier in the book:

After Listing 9.42, Hartl’s Rails Tutorial says

If we omitted the attr_accessible list in the User model (or foolishly added :admin to the list), a malicious user could send a PUT request as follows:

put /users/17?admin=1

The corresponding exercise (exercise 9.6.1) in the tutorial says

add a test to verify that the User admin attribute isn’t accessible

I have completed that test with this code in user_spec.rb:

expect do
  @user.update_attributes(:admin => true)
end.to raise_error(ActiveModel::MassAssignmentSecurity::Error)

But I used stackoverflow to get that test. This was my original idea (in user_pages_spec.rb):

expect do
    put user_path(user) + "?admin=1"
end.to raise_error(ActiveModel::MassAssignmentSecurity::Error) # or some other error

But I couldn’t get it to work.

So my questions are:

  1. Is my idea possible? Isn’t it better to test directly for what a potential hacker might do from the command line? Isn’t that the idea of Capybara, testing user actions?

  2. If it is possible, is there a difference between testing mass assignment and testing the PUT action?

  3. If it isn’t possible, why? Is it just not necessary or am I missing something here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I think I would argue with you that your test is actually better. Some would argue that the given answer is testing Rails functionality which really isn’t your job. However, I do think it’s frequently good to test things in several different directions.

    I was under the impression from back in my school days that it was impossible to send data via the URI except when doing a GET. A quick search of stackoverflow didn’t result in any confirmation. However, the wikipedia article seems to imply it:

    http://en.wikipedia.org/wiki/POST_%28HTTP%2

    I think the correct line of code would be

    put user_path(user), {user: {admin: 1}, id: user.id}

    I hope that helps.

    • 0