提交 73b9d2bb 编写于 作者: D Dave Worth

Do not warn for Mass Assignment on `#update_attribute`

上级 c04f7645
......@@ -25,7 +25,6 @@ class Brakeman::CheckMassAssignment < Brakeman::BaseCheck
Brakeman.debug "Finding possible mass assignment calls on #{models.length} models"
calls = tracker.find_call :chained => true, :targets => models, :methods => [:new,
:attributes=,
:update_attribute,
:update_attributes,
:update_attributes!,
:create,
......
......@@ -26,7 +26,6 @@ class Brakeman::CheckWithoutProtection < Brakeman::BaseCheck
Brakeman.debug "Finding all mass assignments"
calls = tracker.find_call :targets => models, :methods => [:new,
:attributes=,
:update_attribute,
:update_attributes,
:update_attributes!,
:create,
......
......@@ -20,4 +20,9 @@ class OtherController < ApplicationController
def test_send_file
send_file params[:file]
end
def test_update_attribute
@user = User.first
@user.update_attribute(:attr, params[:attr])
end
end
......@@ -20,4 +20,9 @@ class OtherController < ApplicationController
def test_send_file
send_file params[:file]
end
def test_update_attribute
@user = User.first
@user.update_attribute(:attr, params[:attr])
end
end
......@@ -82,6 +82,15 @@ class Rails2Tests < Test::Unit::TestCase
:file => /home_controller\.rb/
end
def test_update_attribute_no_mass_assignment
assert_no_warning :type => :warning,
:warning_type => "Mass Assignment",
:line => 26,
:message => /^Unprotected mass assignment/,
:confidence => 0,
:file => /other_controller\.rb/
end
def test_redirect
assert_warning :type => :warning,
:warning_type => "Redirect",
......
......@@ -104,6 +104,15 @@ class Rails3Tests < Test::Unit::TestCase
:file => /products_controller\.rb/
end
def test_update_attribute_no_mass_assignment
assert_no_warning :type => :warning,
:warning_type => "Mass Assignment",
:line => 26,
:message => /^Unprotected mass assignment near line 26/,
:confidence => 0,
:file => /other_controller\.rb/
end
def test_redirect
assert_warning :type => :warning,
:warning_type => "Redirect",
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册