rules:
- id: check-permit-attributes-medium
  patterns:
  - pattern: $P.permit($ATTRIBUTE)
  - metavariable-regex:
      metavariable: $ATTRIBUTE
      regex: .*(role|banned).*
  message: Calling `permit` on security-critical properties like `$ATTRIBUTE` may leave your application
    vulnerable to mass assignment.
  languages:
  - ruby
  severity: WARNING
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_permit_attributes.rb
    category: security
    cwe:
    - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes'
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    technology:
    - ruby
    - rails
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW