Question

In Rails 3, we can define the accessible attributes:

attr_accessible :rating, :review

In this model, there is additional user_id which is protected to prevent forgery/hacking. This value is assigned in the controller:

@review.user_id = current_user.id

If I use Firebug to manually include the user_id, it will be part of the params[:review], but of course since user_id is not defined in the attr_accessible, it wouldn’t get saved into the database. Such case is rather secure.

Question 1

I read in Rails 3 In Action book, Yehuda Katz included .delete method to delete unauthorized params before further action is performed: params[:review].delete(:user_id). Should I include this as well to further secure my app, or just ignore this step?

Question 2

If I should include the method above, I would like to have something like .delete_all_except to just strip it to the allowed attributes in the params. How do I do that?

Thanks.

Answer 1

If enabled, Rails 3.2 will through an exception if additional mass-assignment params are sent to the model

config/application.rb

config.active_record.whitelist_attributes = true

Rather than deleting out parameters you don’t want, I recommend only accepting parameters you do want:

@user.update_attributes params[:user].slice(:rating, :review)

This will only return the user params you allow.

note: in Rails 4 (coming soonish), this behavior is implemented with a DSL named strong-parameters. You can install this gem in Rails 3.2 to implement now:

@user.update_attributes params.require(:user).permit(:rating, :review)