Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-011

Mass assignment via update with raw params

highRubyCWE-915CVSS 7.5

What it detects

Passing unfiltered params directly to update or update_attributes allows mass assignment.

How to fix

Filter params through strong parameters before passing them to update.

Vulnerable — Shield flags thisprofiles_controller.rb
class ProfilesController < ApplicationController
  def update
    @profile = Profile.find(params[:id])
    @profile.update(params)
    redirect_to @profile
  end
end
Fixed — scans cleanprofiles_controller.rb
class ProfilesController < ApplicationController
  def update
    @profile = Profile.find(params[:id])
    @profile.update(params.require(:profile).permit(:display_name, :bio))
    redirect_to @profile
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-011: Mass assignment via update with raw params — Zennoxa Shield