def process_result res
call = res[:call]
check = check_call call
if check and original? res
model = tracker.models[res[:chain].first]
attr_protected = (model and model.attr_protected)
if attr_protected and tracker.options[:ignore_attr_protected]
return
elsif input = include_user_input?(call.arglist)
first_arg = call.first_arg
if call? first_arg and (first_arg.method == :slice or first_arg.method == :only)
return
elsif not node_type? first_arg, :hash
if attr_protected
confidence = :medium
else
confidence = :high
end
else
return
end
elsif node_type? call.first_arg, :lit, :str
return
else
confidence = :weak
input = nil
end
warn :result => res,
:warning_type => "Mass Assignment",
:warning_code => :mass_assign_call,
:message => "Unprotected mass assignment",
:code => call,
:user_input => input,
:confidence => confidence
end
res
end