2 files changed, 70 insertions, 0 deletions
diff --git a/activemodel/lib/active_model/mass_assignment_security/permission_set.rb b/activemodel/lib/active_model/mass_assignment_security/permission_set.rb
new file mode 100644
index 0000000000..978da493d7
--- /dev/null
+++ b/activemodel/lib/active_model/mass_assignment_security/permission_set.rb
@@ -0,0 +1,41 @@
+require 'active_model/mass_assignment_security/sanitizer'
+
+module ActiveModel
+  module MassAssignmentSecurity
+
+    class PermissionSet < Set
+      attr_accessor :logger
+
+      def +(values)
+        super(values.map(&:to_s))
+      end
+
+      def include?(key)
+        super(remove_multiparameter_id(key))
+      end
+
+      protected
+
+        def remove_multiparameter_id(key)
+          key.gsub(/\(.+/, '')
+        end
+    end
+
+    class WhiteList < PermissionSet
+      include Sanitizer
+
+      def deny?(key)
+        !include?(key)
+      end
+    end
+
+    class BlackList < PermissionSet
+      include Sanitizer
+
+      def deny?(key)
+        include?(key)
+      end
+    end
+
+  end
+end
+\ No newline at end of file
diff --git a/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb
new file mode 100644
index 0000000000..275e481fb8
--- /dev/null
+++ b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb
@@ -0,0 +1,29 @@
+module ActiveModel
+  module MassAssignmentSecurity
+    module Sanitizer
+
+      # Returns all attributes not denied by the authorizer.
+      def sanitize(attributes)
+        sanitized_attributes = attributes.reject { |key, value| deny?(key) }
+        debug_protected_attribute_removal(attributes, sanitized_attributes) if debug?
+        sanitized_attributes
+      end
+
+      protected
+
+        def debug_protected_attribute_removal(attributes, sanitized_attributes)
+          removed_keys = attributes.keys - sanitized_attributes.keys
+          warn!(removed_keys) if removed_keys.any?
+        end
+
+        def debug?
+          self.logger.present?
+        end
+
+        def warn!(attrs)
+          self.logger.debug "WARNING: Can't mass-assign protected attributes: #{attrs.join(', ')}"
+        end
+
+    end
+  end
+end