rules:
- id: mass-assignment-protection-disabled
  pattern: $MODEL.new(params[...], ..., :without_protection => true, ...)
  message: >-
    Mass assignment protection disabled for '$MODEL'. This could
    permit assignment to sensitive model fields without intention. Instead,
    use 'attr_accessible' for the model or disable mass assigment using
    'config.active_record.whitelist_attributes = true'.
    ':without_protection => true' must be removed for this to take effect.
  metadata:
    cwe: 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes'
    owasp: 'A1: Injection'
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/mass_assignment/index.markdown
    category: security
    technology:
    - ruby
  severity: WARNING
  languages:
  - ruby