CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
A developer uses Ruby on Rails with 'attr_accessible' and 'strong parameters'. A security audit praises this pattern. What attack does Rails' strong parameters pattern specifically defend against?
- A.Mass assignment: Rails strong parameters require explicit whitelisting of which request parameters are permitted to be assigned to model attributes, preventing attackers from injecting unexpected parameters (like 'admin: true') that the ORM would otherwise update directly
- B.SQL injection via ActiveRecord queries
- C.CSRF attacks on form submissions
- D.XSS via ERB template rendering
Why A is correct
Mass assignment occurs when a web framework automatically maps request parameters to model attributes without restriction. An attacker can add unexpected fields (like 'role=admin' or 'balance=999999') to a form submission or PATCH request body. Rails' strong parameters require 'params.permit(:field1, :field2)' before mass assignment, acting as an explicit allowlist. This is directly analogous to Django's explicit serializer fields and Node.js's body validation.
Know someone studying for Web App Fundamentals? Send them this one.