Add change note and update severity

github · Mar 22, 2024 · 01f7124 · 01f7124
1 parent b741453
commit 01f7124
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/ruby/ql/src/change-notes/2024-03-22-mass-assignment.md b/ruby/ql/src/change-notes/2024-03-22-mass-assignment.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `ruby/insecure-mass-assignment`, for finding instances of mass assignment operations accepting arbitrary parameters from remote user input.
diff --git a/ruby/ql/src/queries/security/cwe-915/MassAssignment.ql b/ruby/ql/src/queries/security/cwe-915/MassAssignment.ql
@@ -3,7 +3,7 @@
  * @description Using mass assignment with user-controlled attributes allows unintended parameters to be set.
  * @kind path-problem
  * @problem.severity error
- * @security-severity 7.5
+ * @security-severity 9.8
  * @precision high
  * @id ruby/insecure-mass-assignment
  * @tags security