ActiveRecord attempts to mass-assign protected attributes of nested records

In 2.3.9, a commit was introduced to fix #5053 (12bbc34aca509aba5032e8cc8859ef0c0c845cca, https://github.com/rails/rails/commit/12bbc34aca509aba5032e8cc8859e... ).

This is actually a back port of a 3.0 commit:

https://github.com/rails/rails/commit/0057d2df71ec7c2a788acd3b4bade...

So the problem probably exists in 3.0 too.

There is a problem with the line:

t.attributes = f.attributes.except(*keys)

since this can result in an attempt to mass-assign attributes in t that have been protected against mass-assignment with attr_accessible / attr_protected. At one level, this isn't a problem since rails ignores those changes (so things in t won't be changed), but it does log a WARNING

WARNING: Can't mass-assign these protected attributes: created_at, updated_at, parent_id, state

(if you are using libraries like http://henrik.nyh.se/uploads/whiny_protected_attributes.rb then it throws an error too.)

You can work around this by adding additional elements keys so that all protected attributes are excluded.

#current code
keys = ["id"] + t.changes.keys + (f.attribute_names - t.attribute_names)                      

# now make sure any blacklisted attributes aren't assigned                
keys += t.class.protected_attributes.to_a    
                      
#if a whitelist exists, make sure anything present in f that isn't in the whitelist is excluded          
f.attributes.each { |attrib_name, attrib_value| keys << attrib_name unless t.class.accessible_attributes.include?(attrib_name) }

There is one thing I'm worried about that may be a problem now (and wouldn't be fixed by my proposed change) is that if there are any protected attributes in t that should be copied over from f?

If so, we'd need to also do something after the mass-assignment line to copy those values across one by one.