Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-010

Mass assignment via permit bang

highRubyCWE-915CVSS 7.5

What it detects

Calling permit! bypasses strong parameter filtering and allows assignment of any attribute.

How to fix

Explicitly permit only the required attributes with permit(:a, :b).

Vulnerable — Shield flags thisaccounts_controller.rb
class AccountsController < ApplicationController
  def update
    @account = Account.find(params[:id])
    @account.update(params.require(:account).permit!)
    redirect_to @account
  end
end
Fixed — scans cleanaccounts_controller.rb
class AccountsController < ApplicationController
  def update
    @account = Account.find(params[:id])
    @account.update(params.require(:account).permit(:name, :email))
    redirect_to @account
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-010: Mass assignment via permit bang — Zennoxa Shield