rules:
- id: model-attributes-attr-accessible
  patterns:
  - pattern-not: |
      class $CLASS
      ...
      attr_accessible :$XXX
      ...
      end
      ...
      $CLASS.$FUNC(...)
  - pattern: |
      class $CLASS
      ...
      end
      ...
      $CLASS.$FUNC(...)
  message: >-
    Checks for models that do not use attr_accessible. This means there is no limiting
    of which variables can be manipulated
    through mass assignment. For newer Rails applications, parameters should be allowlisted
    using strong parameters.
    For older Ruby versions, they should be allowlisted using strong_attributes.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_model_attributes.rb
    category: security
    technology:
    - rails
  languages:
  - ruby
  severity: ERROR