1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
|
require "cases/helper"
require 'models/company'
require 'models/subscriber'
require 'models/keyboard'
require 'models/task'
require 'models/person'
class MassAssignmentSecurityTest < ActiveRecord::TestCase
def setup
# another AR test modifies the columns which causes issues with create calls
TightPerson.reset_column_information
LoosePerson.reset_column_information
end
def test_customized_primary_key_remains_protected
subscriber = Subscriber.new(:nick => 'webster123', :name => 'nice try')
assert_nil subscriber.id
keyboard = Keyboard.new(:key_number => 9, :name => 'nice try')
assert_nil keyboard.id
end
def test_customized_primary_key_remains_protected_when_referred_to_as_id
subscriber = Subscriber.new(:id => 'webster123', :name => 'nice try')
assert_nil subscriber.id
keyboard = Keyboard.new(:id => 9, :name => 'nice try')
assert_nil keyboard.id
end
def test_mass_assigning_invalid_attribute
firm = Firm.new
assert_raise(ActiveRecord::UnknownAttributeError) do
firm.attributes = { "id" => 5, "type" => "Client", "i_dont_even_exist" => 20 }
end
end
def test_assign_attributes_uses_default_scope_when_no_scope_is_provided
p = LoosePerson.new
p.assign_attributes(attributes_hash)
assert_default_attributes(p)
end
def test_assign_attributes_skips_mass_assignment_security_protection_when_without_protection_is_used
p = LoosePerson.new
p.assign_attributes(attributes_hash, :without_protection => true)
assert_all_attributes(p)
end
def test_assign_attributes_with_default_scope_and_attr_protected_attributes
p = LoosePerson.new
p.assign_attributes(attributes_hash, :as => :default)
assert_default_attributes(p)
end
def test_assign_attributes_with_admin_scope_and_attr_protected_attributes
p = LoosePerson.new
p.assign_attributes(attributes_hash, :as => :admin)
assert_admin_attributes(p)
end
def test_assign_attributes_with_default_scope_and_attr_accessible_attributes
p = TightPerson.new
p.assign_attributes(attributes_hash, :as => :default)
assert_default_attributes(p)
end
def test_assign_attributes_with_admin_scope_and_attr_accessible_attributes
p = TightPerson.new
p.assign_attributes(attributes_hash, :as => :admin)
assert_admin_attributes(p)
end
def test_new_with_attr_accessible_attributes
p = TightPerson.new(attributes_hash)
assert_default_attributes(p)
end
def test_new_with_attr_protected_attributes
p = LoosePerson.new(attributes_hash)
assert_default_attributes(p)
end
def test_create_with_attr_accessible_attributes
p = TightPerson.create(attributes_hash)
assert_default_attributes(p, true)
end
def test_create_with_attr_protected_attributes
p = LoosePerson.create(attributes_hash)
assert_default_attributes(p, true)
end
def test_new_with_admin_scope_with_attr_accessible_attributes
p = TightPerson.new(attributes_hash, :as => :admin)
assert_admin_attributes(p)
end
def test_new_with_admin_scope_with_attr_protected_attributes
p = LoosePerson.new(attributes_hash, :as => :admin)
assert_admin_attributes(p)
end
def test_create_with_admin_scope_with_attr_accessible_attributes
p = TightPerson.create(attributes_hash, :as => :admin)
assert_admin_attributes(p, true)
end
def test_create_with_admin_scope_with_attr_protected_attributes
p = LoosePerson.create(attributes_hash, :as => :admin)
assert_admin_attributes(p, true)
end
def test_new_with_without_protection_with_attr_accessible_attributes
p = TightPerson.new(attributes_hash, :without_protection => true)
assert_all_attributes(p)
end
def test_new_with_without_protection_with_attr_protected_attributes
p = LoosePerson.new(attributes_hash, :without_protection => true)
assert_all_attributes(p)
end
def test_create_with_without_protection_with_attr_accessible_attributes
p = TightPerson.create(attributes_hash, :without_protection => true)
assert_all_attributes(p)
end
def test_create_with_without_protection_with_attr_protected_attributes
p = LoosePerson.create(attributes_hash, :without_protection => true)
assert_all_attributes(p)
end
def test_protection_against_class_attribute_writers
[:logger, :configurations, :primary_key_prefix_type, :table_name_prefix, :table_name_suffix, :pluralize_table_names,
:default_timezone, :schema_format, :lock_optimistically, :record_timestamps].each do |method|
assert_respond_to Task, method
assert_respond_to Task, "#{method}="
assert_respond_to Task.new, method
assert !Task.new.respond_to?("#{method}=")
end
end
private
def attributes_hash
{
:id => 5,
:first_name => 'Josh',
:gender => 'm',
:comments => 'rides a sweet bike'
}
end
def assert_default_attributes(person, create = false)
unless create
assert_nil person.id
else
assert !!person.id
end
assert_equal 'Josh', person.first_name
assert_equal 'm', person.gender
assert_nil person.comments
end
def assert_admin_attributes(person, create = false)
unless create
assert_nil person.id
else
assert !!person.id
end
assert_equal 'Josh', person.first_name
assert_equal 'm', person.gender
assert_equal 'rides a sweet bike', person.comments
end
def assert_all_attributes(person)
assert_equal 5, person.id
assert_equal 'Josh', person.first_name
assert_equal 'm', person.gender
assert_equal 'rides a sweet bike', person.comments
end
end
|
