diff --git a/lib/active_model/forbidden_attributes_protection.rb b/lib/active_model/forbidden_attributes_protection.rb index d189b93..8ac1fa4 100644 --- a/lib/active_model/forbidden_attributes_protection.rb +++ b/lib/active_model/forbidden_attributes_protection.rb @@ -1,8 +1,12 @@ +require 'active_support/concern' + module ActiveModel class ForbiddenAttributes < StandardError end module ForbiddenAttributesProtection + extend ActiveSupport::Concern + def sanitize_for_mass_assignment(*options) new_attributes = options.first if !new_attributes.respond_to?(:permitted?) || new_attributes.permitted? @@ -11,5 +15,11 @@ def sanitize_for_mass_assignment(*options) raise ActiveModel::ForbiddenAttributes end end + + module ClassMethods + def attributes_protected_by_default + [] + end + end end end diff --git a/test/active_model_mass_assignment_taint_protection_test.rb b/test/active_model_mass_assignment_taint_protection_test.rb index e82c8f1..95a4b21 100644 --- a/test/active_model_mass_assignment_taint_protection_test.rb +++ b/test/active_model_mass_assignment_taint_protection_test.rb @@ -1,6 +1,12 @@ require 'test_helper' -class Person +class Base + def self.attributes_protected_by_default + ['id', 'type'] + end +end + +class Person < Base include ActiveModel::MassAssignmentSecurity include ActiveModel::ForbiddenAttributesProtection @@ -23,8 +29,8 @@ class ActiveModelMassUpdateProtectionTest < ActiveSupport::TestCase test "regular attributes should still be allowed" do assert_nothing_raised do - assert_equal({ :a => "b" }, - Person.new.sanitize_for_mass_assignment(:a => "b")) + assert_equal({ :a => "b", :id => 1, :type => 'Type' }, + Person.new.sanitize_for_mass_assignment(:a => "b", :id => 1, :type => 'Type')) end end end