Rails Ruby on Rails

In my mind, the _ids= setter methods are very dangerous. I'd say typically people use update_attributes, and typically people don't make all of their models attr_acessible.

This combination leads to the situation where malicious users can do very unexpected things, very easily.

The regular others= method is safe because you can't get classes through a form post, but getting a list of ids through a form post is a no brainer.

Nested Attributes are very well done, safe by default. You have to turn them on, you even have to explicitly turn on the ability to destroy. Giving every has_many association a unprotected id setter is just not safe by default.

So what I propose, and if there is support for this I can code it up, is a Rails::Application level config flag that would cause the ids= to not be created. In my mind, at some point moving forward, this should go from being off by default, to on by default. But that's a decision of others to make. Perhaps there could also be an option to has_many to enable the creation of the ids= setter, even if the app level flag is set to disable them.

Other options would be to keep the other_ids= setters, but make them attr_protected. This is a little bit uglier, since there is a dependency if you have already called attr_accessible we would need to detect that, and not do anything in that case. But also doable.

Thoughts? Am I the only one who thinks these are dangerous methods to create by default?