H2 - Implement Mass-Assignment and IDOR Fixes in RequestsController

[cycomachead]

General Info

• Pivotal Tracker Story
• Breaking?

Changes

Addresses two security vulnerabilities identified in an earlier audit of RequestsController:

Mass-assignment fix
Removed :user_id from the request_params permit list. Previously, a student could pass a user_id in the request body to file or reassign a request under another user's identity. Ownership is now set explicitly by the controller (user: @user in create, user: student in create_for_student).

IDOR fixes

• Added assignment_in_course? helper that scopes assignment lookups to the current @course's CourseToLms records. Without this, a user could pass an assignment_id from a different course and have it silently accepted. This guard is applied in create, update, and create_for_student.
• Added student_enrolled_in_course? helper that verifies the target student has a student enrollment in @course before an instructor can file a request on their behalf in create_for_student. Previously, any valid user_id would be accepted regardless of course membership.

Incidental factory fix
Offset the canvas_uid sequence in the User factory by 100_000 to prevent collisions with low literal UIDs (e.g. '123', '566') used directly in existing specs.

Testing

Added a Mass-assignment and IDOR protections describe block to spec/controllers/requests_controller_spec.rb covering:

• user_id in create params is ignored; request is assigned to the authenticated user
• Cross-course assignment_id is rejected in create, update, and create_for_student
• create_for_student rejects an unenrolled student and succeeds for an enrolled one

Full non-feature suite: 431 examples, 0 failures.

Documentation

No additional documentation required. These are security hardening changes with no user-facing behavior changes for legitimate use cases.

Checklist

• Name of branch corresponds to story

---

Superconductor Ticket Implementation | App Preview | Guided Review