mcp-server-semgrep/semgrep-rules/ruby/lang/security/mass-assignment-protection-disabled.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: mass-assignment-protection-disabled
  pattern: $MODEL.new(params[...], ..., :without_protection => true, ...)
  message: >-
    Mass assignment protection disabled for '$MODEL'. This could
    permit assignment to sensitive model fields without intention. Instead,
    use 'attr_accessible' for the model or disable mass assigment using
    'config.active_record.whitelist_attributes = true'.
    ':without_protection => true' must be removed for this to take effect.
  metadata:
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes'
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/mass_assignment/index.markdown
    category: security
    technology:
    - ruby
    references:
    - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  severity: WARNING
  languages:
  - ruby