mcp-server-semgrep/semgrep-rules/ruby/lang/security/model-attr-accessible.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: model-attr-accessible
  message: >-
    Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities.
    Query parameters allowed using permit
    and attr_accessible are checked for allowance of dangerous attributes admin, banned,
    role, and account_id. Also checks for usages of
    params.permit!, which allows everything. Fix: don't allow admin, banned, role,
    and account_id using permit or attr_accessible.
  metadata:
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes'
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attr_accessible.rb
    category: security
    technology:
    - ruby
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages:
  - ruby
  severity: ERROR
  pattern-either:
  - pattern: |
      ....permit(..., :admin, ...)
  - pattern: |
      ....permit(..., :role, ...)
  - pattern: |
      ....permit(..., :banned, ...)
  - pattern: |
      ....permit(..., :account_id, ...)
  - pattern: |
      attr_accessible ..., :admin, ...
  - pattern: |
      attr_accessible ..., :role, ...
  - pattern: |
      attr_accessible ..., :banned, ...
  - pattern: |
      attr_accessible ..., :account_id, ...
  - pattern: |
      params.permit!