AshCredo.Check.Warning.WildcardAcceptOnAction (ash_credo v0.16.0)

Basics

This check has a base priority of high and works with any version of Elixir.

Explanation

Using accept :* on create, update, or soft destroy actions accepts all public attributes, which is a mass-assignment vulnerability. Explicitly list the accepted attributes instead.

create :create do
  accept [:title, :body]
end

Hard destroy actions are not checked: Ash resets their accept to [] at compile time, so an accept list there takes no input. Soft destroys are updates under the hood and honor accept like any other writable action.

Test directories are excluded by default, since test factories and seeds often use accept :* on purpose. Override excluded_paths to scope the check differently.

Check-Specific Parameters

Use the following parameters to configure this check:

:excluded_paths

List of paths or regexes to exclude from this check. Defaults to test directories, since accept :* is often intentional in test setup.

This parameter defaults to [~r/\/test\//, "test"].

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.