activemodel/test/cases/forbidden_attributes_protection_test.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

require 'cases/helper'
require 'models/mass_assignment_specific'

class ActiveModelMassUpdateProtectionTest < ActiveSupport::TestCase
  test "forbidden attributes cannot be used for mass updating" do
    params = { "a" => "b" }
    class << params
      define_method(:permitted?) { false }
    end
    assert_raises(ActiveModel::ForbiddenAttributes) do
      SpecialPerson.new.sanitize_for_mass_assignment(params)
    end
  end

  test "permitted attributes can be used for mass updating" do
    params = { "a" => "b" }
    class << params
      define_method(:permitted?) { true }
    end
    assert_nothing_raised do
      assert_equal({ "a" => "b" },
        SpecialPerson.new.sanitize_for_mass_assignment(params))
    end
  end

  test "regular attributes should still be allowed" do
    assert_nothing_raised do
      assert_equal({ a: "b" },
        SpecialPerson.new.sanitize_for_mass_assignment(a: "b"))
    end
  end
end