mcp-server-semgrep/semgrep-rules/ruby/lang/security/model-attributes-attr-accessible.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: model-attributes-attr-accessible
  patterns:
  - pattern-not: |
      class $CLASS < $TYPE
      ...
      attr_accessible :$XXX
      ...
      end
      ...
      $CLASS.$FUNC(...)
  - pattern: |
      class $CLASS < $TYPE
      ...
      end
      ...
      $CLASS.$FUNC(...)
  - metavariable-pattern:
      metavariable: $TYPE
      patterns:
      - pattern-not-regex: (?i)(Error|Exception)
  - focus-metavariable: $CLASS
  message: >-
    Checks for models that do not use attr_accessible. This means there is no limiting
    of which variables can be manipulated
    through mass assignment. For newer Rails applications, parameters should be allowlisted
    using strong parameters.
    For older Rails versions, they should be allowlisted using strong_attributes.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb
    category: security
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes'
    technology:
    - rails
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages:
  - ruby
  severity: ERROR