Empty all protected attributes when integrate strong_parameters

lib/active_model/forbidden_attributes_protection.rb

@@ -1,8 +1,12 @@
+require 'active_support/concern'
+
 module ActiveModel
   class ForbiddenAttributes < StandardError
   end
 
   module ForbiddenAttributesProtection
+    extend ActiveSupport::Concern
+
     def sanitize_for_mass_assignment(*options)
       new_attributes = options.first
       if !new_attributes.respond_to?(:permitted?) || new_attributes.permitted?
@@ -11,5 +15,11 @@ def sanitize_for_mass_assignment(*options)
         raise ActiveModel::ForbiddenAttributes
       end
     end
+
+    module ClassMethods
+      def attributes_protected_by_default
+        []
+      end
+    end
   end
 end

test/active_model_mass_assignment_taint_protection_test.rb

@@ -1,6 +1,12 @@
 require 'test_helper'
 
-class Person
+class Base
+  def self.attributes_protected_by_default
+    ['id', 'type']
+  end
+end
+
+class Person < Base
   include ActiveModel::MassAssignmentSecurity
   include ActiveModel::ForbiddenAttributesProtection
 
@@ -23,8 +29,8 @@ class ActiveModelMassUpdateProtectionTest < ActiveSupport::TestCase
 
   test "regular attributes should still be allowed" do
     assert_nothing_raised do
-      assert_equal({ :a => "b" },
-        Person.new.sanitize_for_mass_assignment(:a => "b"))
+      assert_equal({ :a => "b", :id => 1, :type => 'Type' },
+        Person.new.sanitize_for_mass_assignment(:a => "b", :id => 1, :type => 'Type'))
     end
   end
 end