Do not warn on "dangerous" attributes using roles

fixes #372

lib/brakeman/checks/check_model_attr_accessible.rb

@@ -20,8 +20,9 @@ class Brakeman::CheckModelAttrAccessible < Brakeman::BaseCheck
 
   def run_check
     check_models do |name, model|
-      accessible_attrs = model[:attr_accessible]
-      accessible_attrs.each do |attribute|
+      model[:attr_accessible].each do |attribute|
+        next if role_limited? model, attribute
+
         SUSP_ATTRS.each do |susp_attr, confidence|
             if susp_attr.is_a?(Regexp) and susp_attr =~ attribute.to_s or susp_attr == attribute 
               warn :model => name,    
@@ -37,6 +38,12 @@ class Brakeman::CheckModelAttrAccessible < Brakeman::BaseCheck
     end
   end
 
+  def role_limited? model, attribute
+    role_accessible = model[:options][:role_accessible]
+    return if role_accessible.nil?
+    role_accessible.include? attribute
+  end
+
   def check_models
     tracker.models.each do |name, model|
       if !model[:attr_accessible].nil?
@@ -44,5 +51,4 @@ class Brakeman::CheckModelAttrAccessible < Brakeman::BaseCheck
       end
     end
   end
- 
 end

lib/brakeman/processors/model_processor.rb

@@ -85,6 +85,9 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
           exp.each_arg do |e|
             if node_type? e, :lit
               args << e.value
+            elsif hash? e
+              @model[:options][:role_accessible] ||= []
+              @model[:options][:role_accessible].concat args
             end
           end
 

test/apps/rails3.1/app/models/user.rb

@@ -25,4 +25,6 @@ class User < ActiveRecord::Base
   scope :all
 
   belongs_to :account
+
+  attr_accessible :admin, :as => :admin
 end

test/tests/rails31.rb

@@ -1033,4 +1033,14 @@ class Rails31Tests < Test::Unit::TestCase
       :confidence => 1,
       :relative_path => "app/controllers/other_controller.rb"
   end
+
+  def test_attr_accessible_with_role
+    assert_no_warning :type => :model,
+      :warning_code => 17,
+      :fingerprint => "77c353ad8e5fc9880775ed436bbfa37b005b43aa2978186de92b6916f46fac39",
+      :warning_type => "Mass Assignment",
+      :message => /^Potentially\ dangerous\ attribute\ admin\ av/,
+      :confidence => 0,
+      :relative_path => "app/models/user.rb"
+  end
 end