Fix Mass Assignment in Camping

Mass assignment in Camping occurs when raw request parameters are piped directly into ActiveRecord models. In these micro-frameworks, the lack of built-in 'Strong Parameters' often leads developers to trust the @input hash implicitly, allowing attackers to overwrite restricted database columns like 'is_admin' or 'user_id' via crafted HTTP payloads.

The Vulnerable Pattern

module Blog::Controllers
  class Profile < R '/profile/(\d+)'
    def post(id)
      @user = User.find(id)
      # VULNERABLE: Directly passing the @input hash to the model
      # An attacker can send 'role=admin' in the POST body to escalate privileges.
      @user.update_attributes(@input)
      render :success
    end
  end
end

The Secure Implementation

The exploit leverages ActiveRecord's ability to update multiple attributes at once. By intercepting the request and adding unauthorized keys to the form data, an attacker can modify fields not intended for public access. The fix implements a strict whitelist strategy using Ruby's Hash#slice method, ensuring that only a predefined set of keys is passed to the persistence layer, effectively neutralizing parameter injection.

module Blog::Controllers
  class Profile < R '/profile/(\d+)'
    def post(id)
      @user = User.find(id)
      # SECURE: Whitelist specific keys from the input hash
      # Only 'bio' and 'display_name' are permitted for update.
      safe_params = @input.slice(:bio, :display_name)
      @user.update_attributes(safe_params)
      render :success
    end
  end
end