{
  "filename": "app/controllers/profiles_controller.rb",
  "rule": "The profile_params method permits only display_name and timezone. It must not permit admin, role, or all parameters with permit! or an empty-hash allowlist.",
  "fixed": "class ProfilesController < ApplicationController\n  private\n\n  def profile_params\n    params.require(:profile).permit(:display_name, :timezone)\n  end\nend\n",
  "broken": "class ProfilesController < ApplicationController\n  private\n\n  def profile_params\n    params.require(:profile).permit(:display_name, :timezone, :admin)\n  end\nend\n",
  "test": {
    "filename": "test/controllers/profile_params_test.rb",
    "source": "require \"test_helper\"\n\nclass ProfileParamsTest < ActiveSupport::TestCase\n  test \"profile fields exclude privilege changes\" do\n    controller = ProfilesController.new\n    controller.params = ActionController::Parameters.new(profile: {\n      display_name: \"Ada\", timezone: \"UTC\", admin: true, role: \"owner\"\n    })\n    allowed = controller.send(:profile_params).to_h\n    assert_equal({\"display_name\" => \"Ada\", \"timezone\" => \"UTC\"}, allowed)\n  end\nend\n",
    "command": "bin/rails test test/controllers/profile_params_test.rb"
  }
}