Trigger Mass Assignment rule on other foreign keys than account_id

[Owpac-doctolib]

Is your feature request related to a problem? Please describe. In order to improve IDOR prevention, it would be interesting to be able to add foreign keys that could trigger warnings from the mass assignment rule.

Describe the solution you'd like One way to solve it would be to introduce a new flag, e.g. --mass-assignment-match customer_id, role_id, card_id This way, whenever there is params.permit(:customer_id) or params.permit(:role_id) it will also trigger a warning as for account_id.

[nikolai-b]

https://github.com/presidentbeef/brakeman/issues/1144 has some background about when checking all *_id was tried.