rails--rails/activemodel/test/cases/forbidden_attributes_protection_test.rb

require 'cases/helper'
require 'active_support/core_ext/hash/indifferent_access'
require 'models/account'

class ProtectedParams < ActiveSupport::HashWithIndifferentAccess
  attr_accessor :permitted
  alias :permitted? :permitted

  def initialize(attributes)
    super(attributes)
    @permitted = false
  end

  def permit!
    @permitted = true
    self
  end
end

class ActiveModelMassUpdateProtectionTest < ActiveSupport::TestCase
  test "forbidden attributes cannot be used for mass updating" do
    params = ProtectedParams.new({ "a" => "b" })
    assert_raises(ActiveModel::ForbiddenAttributes) do
      Account.new.sanitize_for_mass_assignment(params)
    end
  end

  test "permitted attributes can be used for mass updating" do
    params = ProtectedParams.new({ "a" => "b" }).permit!
    assert_nothing_raised do
      assert_equal({ "a" => "b" },
        Account.new.sanitize_for_mass_assignment(params))
    end
  end

  test "regular attributes should still be allowed" do
    assert_nothing_raised do
      assert_equal({ a: "b" },
        Account.new.sanitize_for_mass_assignment(a: "b"))
    end
  end
end