# Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter

Rails nested attributes with allow_destroy:false skip the reject_if proc when _destroy is supplied, letting attackers apply rejected attribute changes.

- Payout: hidden
- Severity: high
- Program: Ruby on Rails
- Found by: jcoyne
- Disclosed: 2016-02-12
- CVE: CVE-2015-7577
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/90457
- Library page: https://bugbountylibrary.com/r/h1%3A90457
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:access-control vuln:business-logic

**Target:** Active Record nested attributes (accepts_nested_attributes_for)
**Root cause:** Commit a9b4b5d made the _destroy flag short-circuit the :reject_if proc assuming the record would be destroyed, but with allow_destroy:false the record is not destroyed and the rejection is skipped.
**Steps:**
1. Configure a model with `accepts_nested_attributes_for :assoc, allow_destroy: false, reject_if: :some_proc`.
2. Submit nested attributes for the association including `_destroy` set to a truthy value.
3. Observe the reject_if proc is not invoked and the attributes are applied to the record.
**How found:** Code reading of commit a9b4b5d revealed the _destroy short-circuit assumed destruction, which is false when allow_destroy is disabled.
**Exploitation:** Attacker submits nested attribute params with `_destroy` set, bypassing reject_if to set invalid values or clear all attributes on associated records.
**Insight:** When a guard flag short-circuits validation logic, check whether the condition it assumes (record destruction) actually holds under all option combinations like allow_destroy:false.