def find_mass_assign_calls
return @mass_assign_calls if @mass_assign_calls
models = []
tracker.models.each do |name, m|
if m.is_a? Hash
p m
end
if m.unprotected_model?
models << name
end
end
return [] if models.empty?
Brakeman.debug "Finding possible mass assignment calls on #{models.length} models"
@mass_assign_calls = tracker.find_call :chained => true, :targets => models, :methods => [:new,
:attributes=,
:update_attributes,
:update_attributes!,
:create,
:create!,
:build,
:first_or_create,
:first_or_create!,
:first_or_initialize!,
:assign_attributes,
:update
]
end